Is CVE-2017-17840 actively exploited?

No active exploitation of CVE-2017-17840 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2017-17840 be exploited remotely?

No. CVE-2017-17840 requires local access to exploit.

What is the CVSS score of CVE-2017-17840?

CVE-2017-17840 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2017-17840

HIGH

CVE-2017-17840

CWE-119Published: December 27, 2017· Updated: Jun 17, 2026

7.8

CVSS v3.1

Official Description

An issue was discovered in Open-iSCSI through 2.0.875. A local attacker can cause the iscsiuio server to abort or potentially execute code by sending messages with incorrect lengths, which (due to lack of checking) can lead to buffer overflows, and result in aborts (with overflow checking enabled) or code execution. The process_iscsid_broadcast function in iscsiuio/src/unix/iscsid_ipc.c does not validate the payload length before a write operation.

NVD Source

Technical Analysis

CVE-2017-17840 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.

From a weakness classification perspective (CWE-119): Buffer overflow vulnerabilities can lead to arbitrary code execution or denial of service by corrupting adjacent memory.