CVE-2017-9833

Medium PUBLISHED

/cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root privileges....

Boa · Boa Web Server

Not yet in CISA KEV

Exploited in the wild PoC available

Recommended Action

Treat as actively exploited. Assess exposure, apply compensating controls where patching is delayed, and monitor for abuse.

Confidence
Medium
Exploitation Status
Exploited in the wild
Observed in Sensors
No
Attempts (30d)
Unique Attacker IPs
CISA KEV
Not yet in CISA KEV
CVSS / EPSS
7.5 High EPSS 67.7%

At a Glance

/cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root privileges. NOTE: multiple third parties report that this is a system-integrator issue (e.g., a vulnerability on one type of camera) because Boa does not include any wapopen program or any code to read a FILECAMERA variable.

nuclei_scanner
Published
Jun 24, 2017
First Seen
Jun 15, 2026
CVSS
7.5 High
EPSS
67.7%
Remote Low complexity No user interaction Unauthenticated

Recommended Actions

  • Treat as actively exploited. Assess exposure, apply compensating controls where patching is delayed, and monitor for abuse.
  • Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
  • Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.