PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5169 Hanwha Security CVE debrief

CVE-2017-5169 affects Hanwha Techwin Smart Security Manager versions 1.5 and earlier. The issue is described as multiple cross-site request forgery flaws in the bundled Redis and Apache Felix Gogo servers. According to the CVE record, specific HTTP POST requests can be used to gain system-level access to a remote shell session, creating remote code execution risk. NVD lists the issue as CVSS 3.1 7.5 High with network attack vector, user interaction required, and high confidentiality/integrity/availability impact.

Vendor
Hanwha Security
Product
Smart Security Manager
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-09
Original CVE updated
2017-02-09
Advisory published
2017-02-09
Advisory updated
2017-02-09

Who should care

Organizations running Smart Security Manager 1.5 or earlier should treat this as a high-priority issue, especially if the management interface is reachable by users who could be induced to submit requests or if the product is exposed in an operational network.

Technical summary

The vulnerability is a CSRF weakness (CWE-352) in Smart Security Manager deployments that include Redis and Apache Felix Gogo servers. NVD’s vector indicates network exploitation with required user interaction and no privileges, while the CVE description says crafted HTTP POST requests can trigger a remote shell session with system-level access. The affected CPE range in NVD ends at version 1.5 inclusive.

Defensive priority

High. The combination of remote network reachability, user interaction, and potential system-level shell access makes this a significant exposure for any affected deployment.

Recommended defensive actions

  • Confirm whether Smart Security Manager is version 1.5 or earlier and prioritize upgrade or removal of the affected instance.
  • Follow the vendor and US-CERT guidance referenced in ICSA-17-040-01 for available remediation or mitigation steps.
  • Restrict access to the product’s management interfaces to trusted administrative networks only.
  • Review whether CSRF protections and session-handling controls are properly enforced on the exposed administrative functions.
  • Monitor for unexpected HTTP POST activity targeting the product’s administration and bundled service endpoints.

Evidence notes

Core facts are drawn from the CVE description, NVD record, and the US-CERT advisory reference. NVD lists CWE-352 and a CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The CVE description states the issue affects Smart Security Manager 1.5 and prior and can lead to remote code execution through specific HTTP POST requests. No exploit code or unsupported remediation claims are included.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5169 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5169

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5169 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5169

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.