← Vulnerability feed

Vulnerability record · CVE-2017-6526 · published 9 March 2017

CVE-2017-6526: dnaLIMS unauthenticated command execution via admin web shell

Dnatools · Dnalims

dnaTools dnaLIMS 4-2015s13 exposes an improperly protected administrative web shell at cgi-bin/dna/sysAdmin.cgi that accepts POST requests without authentication. Because the endpoint allows command execution, any network-reachable attacker can run commands on the server. The flaw is rated critical (CVSS 3.0 9.8) and maps to CWE-287 improper authentication.

9.8 CVSS 3.0 Critical EPSS 57% · top 0.9% CWE-287 · Improper authentication
9.8CVSS 3.0 base score, v2 10.0
57%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to unauthenticated command execution through an improperly protected administrative web shell (cgi-bin/dna/sysAdmin.cgi POST requests).

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution with a 9.8 CVSS score, public exploit code, and very high EPSS probability make this an urgent exposure.

What it is

dnaTools dnaLIMS 4-2015s13 exposes an improperly protected administrative web shell at cgi-bin/dna/sysAdmin.cgi that accepts POST requests without authentication. Because the endpoint allows command execution, any network-reachable attacker can run commands on the server. The flaw is rated critical (CVSS 3.0 9.8) and maps to CWE-287 improper authentication.

Impact

An attacker gains remote command execution with the privileges of the web server, enabling data theft, tampering, or use of the host as a pivot into the laboratory network.

Attack surface

Reachable over the network via HTTP POST to cgi-bin/dna/sysAdmin.cgi; no authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is 0.574 (99th percentile) and public exploit code exists on Exploit-DB (41578) plus a vendor advisory tagged Exploit, indicating active public exploitation capability.

What to do

  • Apply the vendor fix or upgrade dnaLIMS past 4-2015s13; if no patch is available, isolate the instance.
  • Restrict network access to the dnaLIMS web interface and especially cgi-bin/dna/sysAdmin.cgi using firewall rules or a reverse proxy allowlist.
  • Require authentication and authorization on all administrative CGI endpoints, including sysAdmin.cgi.
  • Run the web service under a low-privilege account with no shell access and limit outbound network egress from the host.
  • Monitor and block POST requests to cgi-bin/dna/sysAdmin.cgi from untrusted sources.

Detection

  • Alert on POST requests to /cgi-bin/dna/sysAdmin.cgi, particularly from external or unexpected source IPs.
  • Inspect web server logs for command-like parameters or shell metacharacters in requests to dnaLIMS CGI endpoints.
  • Monitor for unexpected child processes spawned by the web server user (e.g., sh, cmd, curl, wget).
  • Review host and network telemetry for outbound connections from the dnaLIMS server to unfamiliar destinations.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/96823
https://www.exploit-db.com/exploits/41578/
https://www.shorebreaksecurity.com/blog/product-security-advisory-psa0002-dnalims/ ExploitTechnical DescriptionThird Party Advisory
http://www.securityfocus.com/bid/96823
https://www.exploit-db.com/exploits/41578/
https://www.shorebreaksecurity.com/blog/product-security-advisory-psa0002-dnalims/ ExploitTechnical DescriptionThird Party Advisory

Track CVE-2017-6526 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2017-6529Dnatools dnalims insufficient session expiration vulnerabilityAn issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to session hijacking by guessing the UID parameter.EPSS 2.9%8.1CVE-2017-6528Dnatools dnalims insufficiently protected credentials vulnerabilityAn issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is affected by plaintext password storage (the /home/dna/spool/.pfile file).EPSS 3.4%7.5CVE-2017-6527dnaLIMS directory traversal in viewAppletFsa.cgi seqID parameterdnaTools dnaLIMS 4-2015s13 is vulnerable to a NUL-terminated directory traversal attack via the seqID parameter of viewAppletFsa.cgi. An unauthentica…EPSS 57%analysed7.5CVE-2026-42018JFrog Artifactory improper authentication leaks anonymous tokenJFrog Artifactory can return an internal anonymous-user token to an unauthenticated caller even when anonymous access is disabled. Because the token …KEVEPSS 9.8%analysed9.8CVE-2026-82329JFrog Artifactory improper authentication allows admin takeoverJFrog Artifactory contains an improper authentication weakness (CWE-287) that, under default configuration, may let an unauthenticated attacker with …KEVEPSS 14%analysed8.8CVE-2026-59822LiteLLM MCP endpoint auth bypass via OAuth2 passthrough fallbackLiteLLM's MCP Streamable HTTP endpoint, prior to 1.84.0, let an unauthenticated attacker send a fabricated Authorization header that triggered an OAu…KEVEPSS 0.84%analysed10.0CVE-2026-49869Kestra OSS auth bypass via path suffix match enables RCEKestra OSS AuthenticationFilter whitelists the public config endpoint using request.getPath().endsWith("/configs"), a suffix match instead of an exac…KEVEPSS 2.1%analysed9.8CVE-2023-49105ownCloud Server WebDAV authentication bypass via pre-signed URLsownCloud core before 10.13.1 accepts pre-signed URLs even when the file owner has no signing-key configured, so the signature check is effectively sk…KEVEPSS 43%analysed

Source: NIST National Vulnerability Database (record CVE-2017-6526), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.