Critical severity · published Jan 24, 2018
CVE-2017-13696
A buffer overflow vulnerability lies in the web server component of Dup Scout Enterprise 9.9.14, Disk Savvy Enterprise 9.9.14, Sync Breeze Enterprise 9.9.16, and Disk Pulse…
9.8
CVSS
78.7%
EPSS
No
On KEV
Description
A buffer overflow vulnerability lies in the web server component of Dup Scout Enterprise 9.9.14, Disk Savvy Enterprise 9.9.14, Sync Breeze Enterprise 9.9.16, and Disk Pulse Enterprise 9.9.16 where an attacker can craft a malicious GET request and exploit the web server component. Successful exploitation of the software will allow an attacker to gain complete access to the system with NT AUTHORITY / SYSTEM level privileges. The vulnerability lies due to improper handling and sanitization of the incoming request.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)78.7% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
Diskpulse · Flexense
9.9.16 · source: NVD
DI
Disksavvy · Flexense
9.9.14 · source: NVD
DU
Dupscout · Flexense
9.9.14 · source: NVD
SY
Syncbreeze · Flexense
9.9.16 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-13696
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-13696
Exploit
https://www.exploit-db.com/exploits/42557
Exploit
https://www.exploit-db.com/exploits/42558/
Exploit
https://www.exploit-db.com/exploits/42559/
Exploit
https://www.exploit-db.com/exploits/42560/
Third Party Advisory
https://www.rapid7.com/db/modules/exploit/windows/http/disk_pulse_enterprise_get
More from Diskpulse
8.0
CVE-2025-59894
Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server
8.0
CVE-2025-59893
Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server
8.0
CVE-2025-59892
Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server
8.0
CVE-2025-59891
Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server
7.8
CVE-2020-36927
DiskPulse 13.6.14 - Unquoted Service Path