Vulnerability record · CVE-2017-13696 · published 24 January 2018
CVE-2017-13696: Flexense Enterprise Products Web Server GET Request Buffer Overflow
Flexense · Dupscout
A buffer overflow in the web server component of Dup Scout Enterprise 9.9.14, Disk Savvy Enterprise 9.9.14, Sync Breeze Enterprise 9.9.16, and Disk Pulse Enterprise 9.9.16 allows a crafted GET request to corrupt memory. The flaw stems from improper handling and sanitization of incoming requests, and successful exploitation yields SYSTEM-level access.
Description
A buffer overflow vulnerability lies in the web server component of Dup Scout Enterprise 9.9.14, Disk Savvy Enterprise 9.9.14, Sync Breeze Enterprise 9.9.16, and Disk Pulse Enterprise 9.9.16 where an attacker can craft a malicious GET request and exploit the web server component. Successful exploitation of the software will allow an attacker to gain complete access to the system with NT AUTHORITY / SYSTEM level privileges. The vulnerability lies due to improper handling and sanitization of the incoming request.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or user interaction, public exploit code, and very high EPSS make this an urgent remote code execution risk.
What it is
A buffer overflow in the web server component of Dup Scout Enterprise 9.9.14, Disk Savvy Enterprise 9.9.14, Sync Breeze Enterprise 9.9.16, and Disk Pulse Enterprise 9.9.16 allows a crafted GET request to corrupt memory. The flaw stems from improper handling and sanitization of incoming requests, and successful exploitation yields SYSTEM-level access.
Impact
An attacker gains complete control of the host with NT AUTHORITY / SYSTEM privileges, enabling arbitrary code execution, data theft, and further lateral movement.
Attack surface
Reachable over the network through the product's web server via a malicious HTTP GET request; the CVSS vector shows no authentication (PR:N) and no user interaction (UI:N) required.
Exploitation
Public exploit code exists in Exploit-DB and a Rapid7 Metasploit module, and EPSS is 0.783 (99.6th percentile), indicating high likelihood of exploitation; the CVE is not listed in CISA KEV.
What to do
- Apply the vendor's patched version for the affected Flexense product as soon as it is available.
- If no patch exists, restrict network access to the web server component to trusted management hosts only.
- Disable or stop the web server feature if it is not required for operations.
- Place the product behind a reverse proxy or WAF that can filter malformed GET requests.
- Monitor vendor advisories for updated fixed versions and upgrade promptly.
Detection
- Inspect web server logs for unusually long or malformed GET requests targeting the Flexense product.
- Monitor for unexpected process creation or SYSTEM-level activity originating from the web server process.
- Use network IDS/IPS signatures for known exploit patterns against these products.
- Alert on crashes or restarts of the Flexense web server service.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.exploit-db.com/exploits/42557 | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/42558/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/42559/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/42560/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.rapid7.com/db/modules/exploit/windows/http/disk_pulse_enterprise_get | Third Party Advisory |
| https://www.exploit-db.com/exploits/42557 | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/42558/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/42559/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/42560/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.rapid7.com/db/modules/exploit/windows/http/disk_pulse_enterprise_get | Third Party Advisory |
Track CVE-2017-13696 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-13696), CISA KEV, FIRST EPSS (scores of 2026-09-25). This page is refreshed as NVD updates the record.
