The ZyXEL P660HN-T1A v1 TCLinux Fw $7

CVE-2017-18368 is an OS command injection in the Remote System Log forwarding feature of the TrueOnline-customized ZyXEL P660HN-T1A v1 router. The vulnerable build is the legacy TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 line, where the unauthenticated ViewLog.asp endpoint accepts attacker-controlled input in the remote_host parameter and executes commands as root. Zyxel says the latest generic firmware 3.40(BYF.11) is not affected and that a patch for the customized model was provided in 2017, but the device itself has been end-of-life for years.

The vendor-style 9.8 is technically defensible because this is pre-auth remote code execution on a perimeter device, and KEV plus botnet use prove attackers care. But for enterprise prioritization, the real-world population is sharply narrower than the score implies: this is an old ISP-customized consumer/SMB router, heavily concentrated outside typical U.S. enterprise fleets, with uncertain WAN reachability in many deployments and frequent replacement by modern managed CPE. So the right call is HIGH, not CRITICAL: if you have it, move fast; if you do not, do not let this outrank broadly deployed enterprise software.

Why this verdict

• Downgrade for narrow population: this is not broad enterprise middleware; it is a legacy TrueOnline-customized router, which sharply reduces reachable fleet size in most enterprise environments.
• Upgrade for exploitation evidence: KEV listing plus observed Gafgyt activity means attackers are already using it, so confirmed exposure should never be treated as routine backlog.
• Downgrade for prerequisite uncertainty: original research explicitly questioned whether exploitation was available over WAN in all cases, and many deployments restrict management to LAN or ISP-only paths.
• Upgrade for edge-device blast radius: when it does land, it is pre-auth command execution as root on a perimeter device, outside normal endpoint controls.

Why not higher?

I am not calling this CRITICAL for enterprise patch planning because too much of the chain depends on owning a very specific end-of-life ISP build and on actual management-plane reachability. In most 10,000-host environments, the limiting factor is not exploit quality but whether this product exists at all and whether attackers can get to the vulnerable endpoint from the internet.

Why not lower?

I am not pushing it down to MEDIUM because the exploit is pre-auth, simple, public, and already used in the wild. KEV plus router-edge execution as root is enough to keep this in HIGH even with a narrow installed base.

1. Block web management from untrusted networks — Immediately restrict access to the router's HTTP management plane to a trusted admin segment or out-of-band path; because this is KEV-listed, do this immediately, within hours. This directly cuts off the unauthenticated ViewLog.asp attack surface.
2. Replace or patch every confirmed instance — If the device is still present, obtain the ISP-specific fixed firmware or replace the unit entirely; for a HIGH verdict the remediation target is within 180 days, but because exploitation is active, do not wait for the outer bound. For EoL branch CPE, replacement is usually more trustworthy than assuming the right custom patch was applied years ago.
3. Monitor router egress for payload retrieval — Create detections for branch-router outbound downloads, unexpected DNS lookups, and unexplained TCP sessions from CPE IPs; deploy this immediately, within hours because KEV overrides the normal mitigation tempo. You are compensating for the fact that routers rarely have host telemetry.
4. Cull the asset class from internet-facing inventory — Use ASM, CMDB, and branch-site audits to identify any P660HN-T1A still in service and remove external exposure; do this immediately, within hours for known internet-facing instances. This is the fastest way to shrink the attack population attackers can actually touch.

Run this on an auditor workstation or CI job, not on the router. Export a CSV from your CMDB, NMS, or ISP-CPE inventory with columns like hostname,model,firmware, then run python3 check_cve_2017_18368.py inventory.csv; no special privileges are needed unless the file location requires them. The script classifies each row as VULNERABLE, PATCHED, or UNKNOWN based on the authoritative version markers published for this CVE.

#!/usr/bin/env python3
# check_cve_2017_18368.py
# Inventory-based verifier for CVE-2017-18368
# Usage: python3 check_cve_2017_18368.py inventory.csv
# CSV columns expected: hostname, model, firmware (case-insensitive names accepted)
# Exit codes:
#   0 = no vulnerable assets found
#   1 = at least one vulnerable asset found
#   2 = usage / file / parsing error

import csv
import re
import sys
from pathlib import Path

VULN_FW_MARKERS = [
    '3.40(ULM.0)b31',
    '7.3.15.0 v001',
    '$7.3.15.0 v001',
]
PATCHED_FW_MARKERS = [
    '3.40(BYF.11)',
]
MODEL_MARKERS = [
    'p660hn-t1a',
    'p660hn t1a',
]


def normalize(value: str) -> str:
    return re.sub(r'\s+', ' ', (value or '').strip()).lower()


def pick(row, *names):
    lowered = {str(k).strip().lower(): v for k, v in row.items()}
    for name in names:
        if name.lower() in lowered:
            return str(lowered[name.lower()] or '').strip()
    return ''


def classify(model: str, firmware: str) -> str:
    m = normalize(model)
    f = firmware.strip()
    fl = normalize(firmware)

    if not any(marker in m for marker in MODEL_MARKERS):
        return 'UNKNOWN'

    if any(marker.lower() in fl for marker in [x.lower() for x in PATCHED_FW_MARKERS]):
        return 'PATCHED'

    if any(marker.lower() in fl for marker in [x.lower() for x in VULN_FW_MARKERS]):
        return 'VULNERABLE'

    if 'byf' in fl:
        return 'PATCHED'

    if 'ulm' in fl and ('b31' in fl or '7.3.15.0' in fl):
        return 'VULNERABLE'

    return 'UNKNOWN'


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 check_cve_2017_18368.py inventory.csv')
        sys.exit(2)

    path = Path(sys.argv[1])
    if not path.exists() or not path.is_file():
        print(f'UNKNOWN - file not found: {path}')
        sys.exit(2)

    vulnerable_count = 0
    processed = 0

    try:
        with path.open(newline='', encoding='utf-8-sig') as fh:
            reader = csv.DictReader(fh)
            if not reader.fieldnames:
                print('UNKNOWN - CSV has no header row')
                sys.exit(2)

            for row in reader:
                processed += 1
                hostname = pick(row, 'hostname', 'host', 'asset', 'device', 'name', 'ip', 'address') or f'row-{processed}'
                model = pick(row, 'model', 'device_model', 'product')
                firmware = pick(row, 'firmware', 'version', 'fw', 'software_version')
                status = classify(model, firmware)
                if status == 'VULNERABLE':
                    vulnerable_count += 1
                print(f'{hostname},{status},model="{model}",firmware="{firmware}"')

    except Exception as exc:
        print(f'UNKNOWN - failed to parse CSV: {exc}')
        sys.exit(2)

    if processed == 0:
        print('UNKNOWN - CSV contained no data rows')
        sys.exit(2)

    if vulnerable_count > 0:
        print(f'VULNERABLE - {vulnerable_count} asset(s) matched CVE-2017-18368 vulnerable firmware markers')
        sys.exit(1)

    print('PATCHED - no assets matched known vulnerable firmware markers')
    sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. NVD CVE-2017-18368
2. CISA KEV Catalog entry
3. CISA alert adding CVE-2017-18368 to KEV
4. Zyxel advisory for CVE-2017-18368
5. Zyxel advisory on Gafgyt exploiting the flaw
6. Unit 42 analysis of Gafgyt targeting CVE-2017-18368
7. Pedro Ribeiro original advisory
8. Rapid7 Metasploit module reference