Login Request a demo
High severity · published Feb 6, 2018
CVE-2017-17996
A buffer overflow vulnerability in "Add command" functionality exists in Flexense SyncBreeze Enterprise <= 10.3.14
8.8
CVSS
5.1%
EPSS
No
On KEV
Description
A buffer overflow vulnerability in "Add command" functionality exists in Flexense SyncBreeze Enterprise <= 10.3.14. The vulnerability can be triggered by an authenticated attacker who submits more than 5000 characters as the command name. It will cause termination of the SyncBreeze Enterprise server and possibly remote command execution with SYSTEM privilege.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.1% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
Syncbreeze · Flexense
through 10.3.14 · source: NVD
Affected product
SY
Syncbreeze
Flexense
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-17996
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-17996
Exploit
http://seclists.org/fulldisclosure/2018/Feb/10
Exploit
http://www.ryantzj.com/flexense-syncbreeze-entreprise-10314-buffer-overflow-seh-bypass.html
More from Syncbreeze
9.8
CVE-2018-6537
A buffer overflow vulnerability in the control protocol of Flexense SyncBreeze Enterprise v10.4.18 allows remote attackers to execute arbitrary code by sending a crafted packet to…
9.8
CVE-2017-13696
A buffer overflow vulnerability lies in the web server component of Dup Scout Enterprise 9.9.14, Disk Savvy Enterprise 9.9.14, Sync Breeze Enterprise 9.9.16, and Disk Pulse…
9.8
CVE-2017-14980
Buffer overflow in Sync Breeze Enterprise 10.0.28 allows remote attackers to have unspecified impact via a long username parameter to /login
8.0
CVE-2025-59894
Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server
8.0
CVE-2025-59893
Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server