CVE-2017-9640

This vulnerability is like a “trick the file location” bug. If someone is already logged in, they may be able to make the system write new (malicious) content into places it shouldn’t, potentially replacing files the server uses to run code.

This matters if your business runs Automated Logic Corporation WebCTRL, i-Vu, or SiteScan Web on a version earlier than 6.5. Exploitation requires valid user credentials, so it’s most relevant when admin or privileged accounts exist and could be abused. Reachability also depends on whether your environment exposes the application/admin functionality in a way that attackers can access; it’s not yet known from the available findings whether it’s reachable by default configuration.

Treat this as AMBER: the risk is elevated because directory-manipulation can let an authenticated attacker overwrite server files with executable content. Public exploitation exists, and interest/attention is rising, but this issue is not listed as confirmed by CISA KEV in the available information.

1. Confirm your installed version

   • Locate the WebCTRL/i-Vu/SiteScan Web version currently deployed.
   • Compare against the advisory statement: versions prior to 6.5 are implicated as affected; version 6.5 is stated as not affected.

2. Determine whether the vulnerable feature surface is reachable

   • Identify how users/admin features are exposed (internal network only vs. internet exposure).
   • Because exploitation requires valid credentials and no user interaction, focus on what accounts can reach the vulnerable functionality and where those accounts can be used.

3. Upgrade or remediate

   • The available findings state that “this vulnerability does not affect version 6.5,” but they do not provide a specific patch package for versions other than that statement.
   • If you are on a version earlier than 6.5, your next step is to contact Automated Logic Corporation support/vendor to get the exact upgrade path/remediation for CVE-2017-9640.

4. Compensating controls while waiting on the vendor fix/upgrade

   • Limit who can log in to the WebCTRL/i-Vu/SiteScan Web application, especially admin-level users.
   • Restrict access by network location (allow only trusted IP ranges/VPN) so only authorized staff can reach the admin UI/API paths.
   • Reduce the number of privileged accounts and disable unused accounts.

5. Look for signs of abuse

   • Check application and server logs for suspicious write/overwrite activity tied to the application (file changes, unexpected errors, unusual admin actions).
   • Review recent authentication events for any abnormal logins to accounts that could reach the affected functionality.

6. What to monitor after changes

   • Monitor for continued attempts to access the vulnerable functionality using altered parameters.
   • Track failed and successful authentication attempts and admin actions following your access-control tightening and upgrade.

CVE-2017-9640 is a path traversal weakness (CWE-22) in Automated Logic Corporation WebCTRL/i-Vu/SiteScan Web. The core mechanism described is directory manipulation that can allow an authenticated user to overwrite existing files on the server—specifically files that are used to execute code—turning file write into code execution.

Findings indicate: network-based attack capability, authentication is required, and no user interaction is needed. A public exploit is available (at least one known), and press attention is rising. CISA KEV is not listed for this CVE in the provided findings, and patch/fixed-package details beyond the “6.5 is not affected” statement are not available here. The overall exposure likelihood estimate provided is a prediction (not used as a proof of exploitation in public guidance).