CVE-2017-14705

CVE-2017-14705 is a critical remote command execution vulnerability affecting DenyAll WAF versions prior to 6.4.1, including i-Suite LTS 5.5.0 through 5.5.12, i-Suite 5.6, and Web Application Firewall 5.7 and 6.x. This flaw allows unauthenticated attackers to execute arbitrary commands on TCP port 3001 by injecting shell metacharacters into the type parameter of the tailDateFile function, often in conjunction with CVE-2017-14706 to obtain the necessary authentication token. The vulnerability carries a CVSSv3 score of 8.1 (High), indicating a severe risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While an authentication token is required, its acquisition via a related vulnerability makes this a significant threat. Despite its high severity, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting a lack of widespread awareness or active targeting.