← Vulnerability feed

Vulnerability record · CVE-2017-17097 · published 2 January 2018

CVE-2017-17097: Gps-server gps tracking software weak password recovery vulnerability

Gps Server · Gps Tracking Software

gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthenticated request, and then sends e-mail with a predictable (date-based) password to the admin, which makes it easier for remote attackers to obtain access by predicting this new password. This is related to the use of gmdate for password creation in fn_connect.php.

9.8 CVSS 3.0 Critical EPSS 6.9% · top 6.1% CWE-640 · Weak password recovery
9.8CVSS 3.0 base score, v2 5.0
6.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthenticated request, and then sends e-mail with a predictable (date-based) password to the admin, which makes it easier for remote attackers to obtain access by predicting this new password. This is related to the use of gmdate for password creation in fn_connect.php.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec PatchThird Party Advisory
https://s1.gps-server.net/changelog.txt Release NotesVendor Advisory
https://www.exploit-db.com/exploits/43431/ ExploitThird Party AdvisoryVDB Entry
https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec PatchThird Party Advisory
https://s1.gps-server.net/changelog.txt Release NotesVendor Advisory
https://www.exploit-db.com/exploits/43431/ ExploitThird Party AdvisoryVDB Entry

Track CVE-2017-17097 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2017-17098Gps-server gps tracking software code injection vulnerabilityThe writeLog function in fn_common.php in gps-server.net GPS Tracking Software (self hosted) through 3.0 allows remote attackers to inject arbitrary …EPSS 6.6%9.8CVE-2023-7028GitLab CE/EE password reset sent to unverified email, enabling account takeoverGitLab CE/EE versions from 16.1 through 16.7 before their fixed releases could deliver account password reset emails to an unverified email address. …KEVEPSS 95%analysed

Source: NIST National Vulnerability Database (record CVE-2017-17097), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.