Vulnerability record · CVE-2017-17932 · published 28 December 2017
CVE-2017-17932: ALLMediaServer MediaServer.exe buffer overflow via TCP port 888
Allmediaserver · Allmediaserver
ALLMediaServer 0.95 and earlier ships MediaServer.exe with a buffer overflow reachable by sending a long string to TCP port 888. Because the flaw is network-reachable with no authentication or user interaction, it can crash the service or allow remote code execution on the host running the media server.
Description
A buffer overflow vulnerability exists in MediaServer.exe in ALLPlayer ALLMediaServer 0.95 and earlier that could allow remote attackers to execute arbitrary code and/or cause denial of service on the victim machine/computer via a long string to TCP port 888.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or user interaction, public exploit code, and a very high EPSS score make this an urgent remote code execution risk for exposed instances.
What it is
ALLMediaServer 0.95 and earlier ships MediaServer.exe with a buffer overflow reachable by sending a long string to TCP port 888. Because the flaw is network-reachable with no authentication or user interaction, it can crash the service or allow remote code execution on the host running the media server.
Impact
An unauthenticated remote attacker can execute arbitrary code in the context of the MediaServer.exe process or cause a denial of service, taking down the media server and potentially the host.
Attack surface
Reached over the network via a long string sent to TCP port 888; the CVSS vector shows no privileges required and no user interaction, so any host that can reach the port can attempt it.
Exploitation
Public exploit code exists in Exploit-DB (43406, 43407, 43523), and EPSS is 0.53597 (98.9th percentile), indicating high near-term exploitation likelihood; the CVE is not listed in CISA KEV.
What to do
- Upgrade or remove ALLMediaServer 0.95 and earlier; no fixed version is stated in this record, so confirm vendor status before relying on a patch.
- Block or restrict inbound TCP port 888 to trusted hosts only.
- Do not expose MediaServer.exe to untrusted networks; bind it to localhost or an internal interface where possible.
- Run the service under a low-privilege account to limit the impact of code execution.
- Monitor for and terminate unexpected MediaServer.exe crashes or restarts.
Detection
- Alert on inbound connections to TCP port 888 from external or unexpected sources.
- Monitor MediaServer.exe for crash events, access violations, or abnormal process restarts.
- Inspect network traffic to port 888 for oversized or malformed payloads.
- Watch for child processes or command execution spawned by MediaServer.exe.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.exploit-db.com/exploits/43406/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/43407/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/43523/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/43406/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/43407/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/43523/ | ExploitThird Party AdvisoryVDB Entry |
Track CVE-2017-17932 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-17932), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
