CVE-2017-18368: Zyxel P660HN-T1A Routers Command Injection Vulnerability

CVE-2017-18368 is a command injection vulnerability in Zyxel P660HN-T1A routers. It affects the Remote System Log forwarding function and can be reached by an unauthenticated user through the remote_host parameter on the ViewLog.asp page. Because the flaw allows remote command execution on a network edge device, successful abuse can give an attacker a foothold on the router itself and potentially the networks it serves. Defenders should treat any internet-facing instance of this model as high priority for inventory and remediation.

How it works

The weakness is classified as CWE-78 (OS Command Injection). In this class of flaw, user-controlled input is passed to a system shell or command interpreter without adequate sanitization. According to the CISA summary, the vulnerable code path is the Remote System Log forwarding feature. An unauthenticated attacker supplies a crafted value in the remote_host parameter of the ViewLog.asp page; that value is then incorporated into a command that the router executes. The result is arbitrary command execution in the context of the router process. Exact payload construction and any secondary effects must be confirmed against the vendor advisory; public detail beyond the parameter and page name is limited.

Am I affected? How to find it in your systems

Zyxel P660HN-T1A devices are consumer and small-office DSL routers that commonly sit at the network perimeter. Inventory efforts should focus on:

• Asset databases, DHCP leases, and network discovery scans that identify Zyxel hardware or the model string P660HN-T1A.
• Management interfaces (HTTP/HTTPS) exposed on the LAN or, more critically, on the WAN; look for the ViewLog.asp page or any remote system-log configuration UI.
• Firmware version and configuration state; confirm whether Remote System Log forwarding is enabled and whether the device is still under vendor support. Exact fixed versions are not listed here and must be verified against the vendor advisory.

Telemetry signs of exploitation are limited in public sources. Monitor for unexpected outbound connections originating from the router, anomalous process or command activity if the platform exposes such logs, and repeated unauthenticated requests to ViewLog.asp that contain unusual characters in the remote_host parameter. Correlate any such activity with changes in router configuration or new administrative sessions.

How to remediate

The primary action is to apply the mitigations or firmware update supplied by the vendor, as directed by CISA: “Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.” Obtain the official advisory and image directly from Zyxel, verify integrity, and install during a maintenance window. After patching, re-validate that the Remote System Log forwarding function no longer accepts unauthenticated input and that the ViewLog.asp endpoint behaves as expected.

Additional hardening steps appropriate to this class of device include:

• Disable remote administration and any unused services, including remote system logging if it is not required.
• Restrict management access to a dedicated management VLAN or jump host.
• Replace end-of-life hardware when vendor support has ended.

If you can't patch immediately

Until a vendor update can be applied, reduce exposure with compensating controls:

• Segment the router so that its management plane is unreachable from untrusted networks; block inbound access to the web interface from the WAN.
• If a web application firewall or IPS is in path, apply a virtual patch that inspects and blocks requests to ViewLog.asp containing shell metacharacters in the remote_host parameter. Confirm rule efficacy against the vendor advisory description.
• Disable the Remote System Log forwarding feature entirely if operationally feasible.
• Increase monitoring: alert on any configuration change, unexpected outbound traffic from the router, or authentication failures against the management interface.
• If the device cannot be adequately protected, plan to take it offline and replace it.

If your data may have been exposed

Actively exploited router vulnerabilities can lead to full network compromise and subsequent data theft. If you believe an affected Zyxel P660HN-T1A may have been compromised, isolate the device, preserve logs, and begin incident-response procedures. As a quick personal check, you can run a free exposure scan of your email address against known breach data sets to see whether credentials or other information associated with your accounts have already appeared in public dumps.