CVE-2017-9822: DNN (DotNetNuke) cookie deserialization remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is a network-reachable remote code execution flaw listed in CISA KEV with known ransomware use and a very high EPSS score.

What it is

DNN (DotNetNuke) before 9.1.1 deserializes attacker-controlled cookie data, allowing remote code execution. The flaw is a code injection (CWE-94) reachable over the network, and it is listed in CISA's Known Exploited Vulnerabilities catalog with documented ransomware campaign use.

Impact

An attacker who can reach the site can execute arbitrary code on the server, leading to full compromise of confidentiality, integrity and availability.

Attack surface

Reached over the network via a crafted cookie; the CVSS vector indicates low privileges are required (PR:L) and no user interaction (UI:N). No further detail on the exact endpoint is given in the record.

Exploitation

CISA KEV lists it as exploited, including known ransomware campaign use, and EPSS is very high (0.94789, 99.855th percentile). Public exploit code is referenced (Packet Storm), so exploitation is active and well understood.

What to do

• Upgrade DNN to 9.1.1 or later per vendor instructions.
• If immediate upgrade is not possible, restrict or block external access to the DNN site and apply vendor-recommended workarounds.
• Rotate any secrets, machine keys and credentials that may have been exposed on affected hosts.
• Monitor and restrict outbound traffic from DNN servers to limit post-exploitation activity.
• Verify no unauthorized web shells or modified files remain after patching.

Detection

• Inspect web server and application logs for anomalous or malformed cookie values sent to DNN endpoints.
• Hunt for unexpected child processes spawned by the web server (w3wp.exe) or unusual command execution.
• Monitor for new or modified files under the DNN web root, especially executable or script files.
• Alert on outbound connections from DNN hosts to unfamiliar external addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.