{"id":"CVE-2017-11193","url":"https://www.cyber-defence.io/tools/cve/CVE-2017-11193","generatedAt":"2026-10-28T20:26:50.510Z","title":"Pulse Connect Secure 8.3R1 has CSRF in diag.cgi.","description":"Pulse Connect Secure 8.3R1 has CSRF in diag.cgi. In the panel, the diag.cgi file is responsible for running commands such as ping, ping6, traceroute, traceroute6, nslookup, arp, and Portprobe. These functions do not have any protections against CSRF. That can allow an attacker to run these commands against any IP if they can get an admin to visit their malicious CSRF page.","published":"2017-07-12T20:29:00.000Z","lastModified":"2026-06-17T01:01:23.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":8.8,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"cwe":["CWE-352"],"affected":["pulsesecure/pulse connect secure"],"epss":{"score":0.0056,"percentile":0.46436,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.56%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"http://www.securityfocus.com/bid/99621","source":"cve@mitre.org"},{"url":"http://www.sxcurity.pro/Multiple%20XSS%20and%20CSRF%20in%20Pulse%20Connect%20Secure%20v8.3R1.pdf","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://twitter.com/sxcurity/status/884556905145937921","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/99621","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.sxcurity.pro/Multiple%20XSS%20and%20CSRF%20in%20Pulse%20Connect%20Secure%20v8.3R1.pdf","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://twitter.com/sxcurity/status/884556905145937921","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-11193","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}