CVE-2017-7310: Flexense disk tools XML import buffer overflow allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS 7.8 with public exploit code and very high EPSS (98.9th percentile) makes this a serious risk for environments still running the affected versions, though exploitation requires local file import and user interaction.

What it is

A buffer overflow in the Import Command of multiple Flexense products (SyncBreeze, DiskSorter, DiskBoss, DiskPulse, DiskSavvy, DupScout, VX Search) before version 10.6 is triggered by a crafted XML file with an oversized name attribute in a classify element. Successful exploitation lets an attacker run arbitrary code in the context of the affected application.

Impact

An attacker who gets a malicious XML file imported can execute arbitrary code with the privileges of the importing process, potentially leading to full compromise of the host. The CVSS 3.0 vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reached locally: the CVSS vector is AV:L with UI:R and PR:N, meaning the attacker must deliver the crafted XML file and rely on a user importing it, with no prior authentication required. The flaw is in the file import path, not a network service.

Exploitation

Public exploit code exists (multiple Exploit-DB entries tagged Exploit), and EPSS is 0.53651 (98.9th percentile), indicating a high likelihood of exploitation activity. The CVE is not listed in CISA KEV and no ransomware group usage is documented.

What to do

• Upgrade all affected Flexense products to version 10.6 or later, which the vendor news pages indicate fixes the issue.
• If immediate upgrade is not possible, restrict or disable the XML import feature and block untrusted XML files from being opened by these applications.
• Train users not to open XML files from untrusted sources, since exploitation requires user interaction to import the file.
• Apply least privilege to accounts running these disk tools to limit the impact of code execution.
• Monitor vendor news pages for the affected products for any further updates or patches.

Detection

• Monitor for processes of the affected Flexense applications spawning unexpected child processes, which may indicate successful code execution after import.
• Inspect XML files imported by these tools for unusually long name attributes in classify elements.
• Review application and system logs for crashes or abnormal termination of the Flexense tools around XML import operations.
• Use file integrity monitoring to detect unexpected changes to the installed Flexense application binaries or configuration.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.