Every CVESearch/Get API key

CVE-2017-1000486

Inadequate Encryption Strength

9.8 CriticalIn KEVPublic exploitFix available

CVE-2017-1000486 is a critical vulnerability (CVSS 9.8) in Primetek Primefaces, published January 3, 2018. CISA lists it as known to be exploited, since January 10, 2022. EUVD reports exploitation since January 10, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 94.1%, the 99th percentile. Fixed in org.primefaces:primefaces 6.0.

Severity
9.8 CriticalCVSS 3.1, NVD
Exploit chance
94.1%EPSS, 99th percentile
Exploitation
ExploitedCISA KEV,
Fixed in
6.0org.primefaces:primefaces +1 more

Description

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

94.1%Up 84.6 points since Apr 14, 2021
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.primefaces:primefaces
Maven
5.0 up to 6.0
6.0
org.primefaces:primefaces
Maven
5.0 up to 6.0, plus listed versions
5.15.25.3
6.0

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitPrimefaces Remote Code Execution Exploit2016-02-15
Exploit-DBPrimefaces 5.x - Remote Code Execution (Metasploit)2018-01-18
PoC in GitHubpimps/CVE-2017-10004862018-09-03
PoC in GitHubmogwailabs/CVE-2017-10004862018-10-17
PoC in GitHubcved-sources/cve-2017-10004862019-01-11
PoC in GitHubPastea/CVE-2017-10004862021-08-05
PoC in GitHubdsssssssm/pwnfaces2022-09-09
PoC in GitHubLongWayHomie/CVE-2017-10004862023-12-15
PoC in GitHubjam620/primefaces2024-02-13
PoC in GitHubkeitan339/primefaces-cve-2017-10004862026-10-28
NucleiPrimetek Primefaces 5.x - Remote Code Execution

What each source reports

NVD Score used9.8

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

Record
CVE-2017-1000486
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-326
Updated
2026-11-02
CVE List9.8

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

Record
CVE-2017-1000486
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-326
Updated
2026-11-02
EUVDEUVD-2021-13399.8

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

Record
EUVD-2021-1339
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-j239-4gqg-5j549.8

Inadequate Encryption Strength

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

Record
GHSA-j239-4gqg-5j54
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-326
Updated
2026-11-02
CISA KEVNo score

Primetek Primefaces Remote Code Execution Vulnerability

Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution

Record
CVE-2017-1000486
Weakness
CWE-326
Updated
2026-11-02
OSVGHSA-j239-4gqg-5j549.8

Inadequate Encryption Strength

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

Record
GHSA-j239-4gqg-5j54
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-326
Updated
2026-11-02

History

History
RecordedChangedSources
exploitation, exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open