Actively exploited · CISA KEV · NVD published 2018-01-03
Actively exploitedCVE-2017-1000486
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
- First PoC
- 2515 days →Metasploit
- 680 days →First cited attacker
Signals
- Exploited in the wild
- Yesadded 2022-01-10 · due 2022-07-10. An observation, not a forecast.
- EPSS · 30-day forecast
- 94%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
- CVSS · NVD · CRITICAL
- 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Internet exposure
- not stated by sourcesNo exposure census on this CVE's dispatches.
Exploits
3 known · links onlyMetasploit1
This module exploits a Java Expression Language remote code execution flaw in the Primefaces JSF framework. Primefaces versions prior to 5.2.21, 5.3.8 or 6.0 are vulnerable to a padding oracle attack, due to the use of weak crypto and default encryption password and salt. Tested against Docker image with Tomcat 7.0 with the Primefaces 5.2 showcase application. See documentation for working payloads.
ruby · seen 2026-10-18
Exploit-DB1
created 2018-01-18
Nuclei1
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution.
yaml · seen 2026-10-18
On the wire
0 dispatchesNo dispatch on our wire has named this CVE yet.
Watch this one?
KEV additions reach Telegram and the KEV-only RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.