{"id":"CVE-2017-18001","url":"https://www.cyber-defence.io/tools/cve/CVE-2017-18001","generatedAt":"2026-10-28T21:34:38.598Z","title":"Trustwave Secure Web Gateway (SWG) through 11.8.0.27 allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, and consequently obtain remote root access, via the publicKey parameter to the /sendKey URI.","description":"Trustwave Secure Web Gateway (SWG) through 11.8.0.27 allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, and consequently obtain remote root access, via the publicKey parameter to the /sendKey URI.","published":"2017-12-31T19:29:00.000Z","lastModified":"2026-06-17T01:12:01.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-306"],"affected":["trustwave/secure web gateway"],"epss":{"score":0.14078,"percentile":0.96545,"date":"2026-10-27","history":[{"date":"2026-09-21","score":0.10725,"percentile":0.95685},{"date":"2026-09-22","score":0.13821,"percentile":0.96348}]},"kev":{"listed":false},"exploits":{"count":1,"verified":false,"firstPublished":"2017-12-26","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":44047,"kind":"exploit","title":"Trustwave SWG 11.8.0.27 - SSH Unauthorized Access","url":"https://www.exploit-db.com/exploits/44047","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/44047.md","file":"exploits/linux/remote/44047.md","published":"2017-12-26","added":"2018-02-15","updated":"2018-02-15","author":"SecuriTeam","type":"remote","platform":"linux","port":null,"verified":false,"codes":["CVE-2017-18001"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://blogs.securiteam.com/index.php/archives/3550"}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 14.1%, higher than 97% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://seclists.org/fulldisclosure/2017/Dec/88","tags":["Exploit","Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://blogs.securiteam.com/index.php/archives/3550","tags":["Exploit","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.exploit-db.com/exploits/44047/","source":"cve@mitre.org"},{"url":"https://www.trustwave.com/Resources/Trustwave-Software-Updates/Important-Security-Update-for-Trustwave-Secure-Web-Gateway/","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://seclists.org/fulldisclosure/2017/Dec/88","tags":["Exploit","Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://blogs.securiteam.com/index.php/archives/3550","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/44047/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.trustwave.com/Resources/Trustwave-Software-Updates/Important-Security-Update-for-Trustwave-Secure-Web-Gateway/","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-18001","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}