CVE-2017-16666: Xplico PCAP filename command injection allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote code execution with public exploit code and a very high EPSS score, though not listed in KEV and requiring either authentication or abuse of registration.

What it is

Xplico before 1.2.1 passes the name of an uploaded PCAP file to a shell without sanitising shell metacharacters, allowing OS command injection. The record notes the issue can also be reached without authentication by abusing the user registration feature, so the practical barrier is low. It matters because successful exploitation yields remote code execution on the Xplico host.

Impact

An attacker gains arbitrary command execution with the privileges of the Xplico service, leading to full compromise of the host and any data it processes.

Attack surface

Reached over the network through the PCAP upload functionality, with the description stating authenticated access is required but that registration can be leveraged to avoid authentication. No user interaction is needed per the CVSS vector.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.808, 99.6th percentile) and multiple references are tagged Exploit, including Exploit-DB, Packet Storm and a Rapid7 Metasploit module, indicating public exploit code exists.

What to do

• Upgrade Xplico to 1.2.1 or later, which the vendor advisory identifies as the fixed release.
• If immediate upgrade is not possible, restrict network access to the Xplico web interface to trusted hosts only.
• Disable or tightly control the user self-registration feature so unauthenticated users cannot reach the upload path.
• Run Xplico with a low-privilege dedicated account and confine it to a container or restricted host to limit command execution impact.
• Monitor and restrict the upload directory and any shell invocation paths used by the PCAP processing pipeline.

Detection

• Review Xplico web server and application logs for PCAP uploads whose filenames contain shell metacharacters such as ;, |, $, backticks or newlines.
• Alert on unexpected child processes spawned by the Xplico service, especially shells or network utilities.
• Monitor for new user registrations followed quickly by file uploads from the same source address.
• Use the available Metasploit and Exploit-DB modules to build IDS/IPS signatures for known exploit request patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.