{"id":"CVE-2017-9097","url":"https://www.cyber-defence.io/tools/cve/CVE-2017-9097","generatedAt":"2026-10-28T20:12:34.150Z","title":"In Anti-Web through 3.8.7, as used on NetBiter FGW200 devices through 3.21.2, WS100 devices through 3.30.5, EC150 devices through 1.40.0, WS200 devices through 3.30.4, EC250 devices through 1.40.0, and other products, an LFI vulnerability allows a…","description":"In Anti-Web through 3.8.7, as used on NetBiter FGW200 devices through 3.21.2, WS100 devices through 3.30.5, EC150 devices through 1.40.0, WS200 devices through 3.30.4, EC250 devices through 1.40.0, and other products, an LFI vulnerability allows a remote attacker to read or modify files through a path traversal technique, as demonstrated by reading the password file, or using the template parameter to cgi-bin/write.cgi to write to an arbitrary file.","published":"2017-06-16T03:29:00.000Z","lastModified":"2026-06-17T01:27:28.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":9.1,"severity":"CRITICAL","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},"cwe":["CWE-22"],"affected":["hoytech/antiweb"],"epss":{"score":0.03731,"percentile":0.89767,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (3.73%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"http://misteralfa-hack.blogspot.cl/2017/05/apps-industrial-ot-over-server-anti-web.html","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/ezelf/industrial_Tools/tree/master/scadas_server_antiweb/LFI","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.netbiter.com/docs/default-source/netbiter-english/software/hms-security-advisory-2017-05-24-001-ws100-ws200-ec150-ec250.zip","tags":["Patch","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://misteralfa-hack.blogspot.cl/2017/05/apps-industrial-ot-over-server-anti-web.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/ezelf/industrial_Tools/tree/master/scadas_server_antiweb/LFI","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.netbiter.com/docs/default-source/netbiter-english/software/hms-security-advisory-2017-05-24-001-ws100-ws200-ec150-ec250.zip","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-9097","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}