Every CVE Search/ Get API key

CVE-2017-1000486

Inadequate Encryption Strength

9.8 CriticalIn KEVPublic exploitFix available

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

94.1%Up 84.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

Record
CVE-2017-1000486
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-326
Updated
2026-11-02
CVE List 9.8

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

Record
CVE-2017-1000486
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-326
Updated
2026-11-02
EUVDEUVD-2021-1339 9.8

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

Record
EUVD-2021-1339
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-j239-4gqg-5j54 9.8

Inadequate Encryption Strength

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

Record
GHSA-j239-4gqg-5j54
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-326
Updated
2026-11-02
CISA KEV No score

Primetek Primefaces Remote Code Execution Vulnerability

Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution

Record
CVE-2017-1000486
Weakness
CWE-326
Updated
2026-11-02
OSVGHSA-j239-4gqg-5j54 9.8

Inadequate Encryption Strength

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

Record
GHSA-j239-4gqg-5j54
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-326
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.primefaces:primefaces
Maven
 5.0 up to 6.0
6.0
org.primefaces:primefaces
Maven
 5.0 up to 6.0, plus listed versions
5.15.25.3
6.0

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitPrimefaces Remote Code Execution Exploit2016-02-15
Exploit-DBPrimefaces 5.x - Remote Code Execution (Metasploit)2018-01-18
PoC in GitHubpimps/CVE-2017-10004862018-09-03
PoC in GitHubmogwailabs/CVE-2017-10004862018-10-17
PoC in GitHubcved-sources/cve-2017-10004862019-01-11
PoC in GitHubPastea/CVE-2017-10004862021-08-05
PoC in GitHubdsssssssm/pwnfaces2022-09-09
PoC in GitHubLongWayHomie/CVE-2017-10004862023-12-15
PoC in GitHubjam620/primefaces2024-02-13
PoC in GitHubkeitan339/primefaces-cve-2017-10004862026-10-28
NucleiPrimetek Primefaces 5.x - Remote Code Execution

History

History
RecordedChangedSources
exploitation, exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-1000486 is a critical vulnerability (CVSS 9.8) in Primetek Primefaces, published January 3, 2018. CISA lists it as known to be exploited, since January 10, 2022. EUVD reports exploitation since January 10, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 94.1%, the 99th percentile. Fixed in org.primefaces:primefaces 6.0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open