How severe is CVE-2017-18045?

CVE-2017-18045 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2017-18045 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (69th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2017-18045?

CVE-2017-18045 affects Directadmin. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2017-18045?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2017-18045 published?

CVE-2017-18045 was published on 2018-01-21 and last updated on 2026-06-17.

CVE-2017-18045

CVE-2017-18045 is a critical-severity vulnerability in Directadmin with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 7.5
EPSS exploit prediction: 1% (69th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Directadmin
Published: 2018-01-21
Last modified: 2026-06-17

Description

JBMC DirectAdmin before 1.52, when the email_ftp_password_change setting is nonzero, allows remote attackers to obtain access or cause a denial of service (segfault) via an unspecified request.

Frequently asked questions

What is CVE-2017-18045?: JBMC DirectAdmin before 1.52, when the email_ftp_password_change setting is nonzero, allows remote attackers to obtain access or cause a denial of service (segfault) via an unspecified request.
How severe is CVE-2017-18045?: CVE-2017-18045 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2017-18045 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (69th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2017-18045?: CVE-2017-18045 affects Directadmin. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2017-18045?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2017-18045 published?: CVE-2017-18045 was published on 2018-01-21 and last updated on 2026-06-17.

References

https://www.directadmin.com/features.php?id=2036

Affected products (1)

cpe:2.3:a:directadmin:directadmin:*:*:*:*:*:*:*:*

More vulnerabilities in Directadmin

CVE-2019-9625 — High (CVSS 8.8): JBMC DirectAdmin 1.55 allows CSRF via the /CMD_ACCOUNT_ADMIN URI to create a new admin account.
CVE-2009-1525 — High (CVSS 8.5): CMD_DB in JBMC Software DirectAdmin before 1.334 allows remote authenticated users to gain privileges via shell…
CVE-2025-56551 — High (CVSS 8.2): An issue in DirectAdmin v1.680 allows unauthorized attackers to manipulate the page layout and replace the legitimate…
CVE-2009-1526 — Medium (CVSS 6.9): JBMC Software DirectAdmin before 1.334 allows local users to create or overwrite any file via a symlink attack on an…
CVE-2007-1926 — Medium (CVSS 6.8): Cross-site scripting (XSS) vulnerability in JBMC Software DirectAdmin before 1.293 does not properly display log files,…
CVE-2019-11193 — Medium (CVSS 6.1): The FileManager in InfinitumIT DirectAdmin through v1.561 has XSS via CMD_FILE_MANAGER, CMD_SHOW_USER, and…

All CVEs affecting Directadmin →