CVE-2017-17759

Published: Dec 19, 2017Updated: May 13, 2026 Sources: CVE List NVD BDUNVD-CWE-noinfo

9.8CRITICAL

NVD MITRE

Description

Conarc iChannel allows remote attackers to obtain sensitive information, modify the configuration, or cause a denial of service (by deleting the configuration) via a wc.dll?wwMaint~EditConfig request (which reaches an older version of a West Wind Web Connection HTTP service).

In plain language

AI Worth attention

If you use Conarc iChannel, a publicly reachable web request can let attackers read sensitive information, change settings, or delete configuration—so you should check your setup and patch urgently if you’re exposed.

Executive summary

Conarc iChannel exposes a wc.dll endpoint that an unauthenticated remote attacker can reach via a crafted request to obtain sensitive information, modify configuration, or delete configuration for denial of service; this is possible through a legacy West Wind Web Connection HTTP service path.

If affected, business impact

Sensitive data exposureUnauthorized configuration changesService outageLoss of stored configuration

What to do now

Check whether your Conarc iChannel server is reachable from the internet and whether the “/wc.dll?wwMaint~EditConfig” endpoint is accessible.
If it is exposed, block external access to the iChannel web server (or restrict access to that specific endpoint) so only trusted networks can reach it.
Update/patch Conarc iChannel to the vendor-fixed version; if you can’t patch right away, keep the endpoint blocked until you do.
Review web server logs for requests to “/wc.dll?wwMaint~EditConfig” from unusual sources, and preserve logs for your IT/vendor.

Some work to apply

What is it

This issue is like leaving a back door in a building’s entrance system unlocked. Attackers can knock on a specific web address without needing a password, then use it to peek at sensitive information, change important settings, or delete configuration so the system stops working. If your iChannel service is publicly reachable, it’s the kind of problem that can quickly turn into downtime and data exposure.

Who is affected

This matters if your business runs Conarc iChannel on a network where attackers can reach its web services. The vulnerability does not require authentication and can be triggered by a specific request pattern. The risk is highest if that “/wc.dll?wwMaint~EditConfig” endpoint is reachable from the internet (or any untrusted network).

How urgent is it

This is urgent because attackers can exploit it without logging in, and public exploits are available. Even if your exact endpoint isn’t exposed, the presence of a reliable attack path means you should treat it as an active, practical risk and verify exposure immediately.

What to do — in detail

Confirm exposure (today)

Identify the Conarc iChannel server(s) and determine where the web service is hosted (public IP, reverse proxy, firewall rules).
From outside your organization (or using your security/IT scanning tool), test whether “/wc.dll?wwMaint~EditConfig” is reachable.
- You are looking for: HTTP response indicating the endpoint exists and accepts requests.
- Do not authenticate during this check.
If you use a reverse proxy/web application firewall, confirm whether it forwards requests for “/wc.dll?wwMaint~EditConfig” to iChannel.
Check your logs for requests to “/wc.dll?wwMaint~EditConfig” and the related wc.dll activity from unexpected IPs or unusual times.

Reduce risk while patching

Apply the vendor’s mitigation by restricting access to the iChannel web server/page “/wc.dll?wwMaint~EditConfig”. Concretely:
- Block external access to the iChannel web server, or
- Restrict that specific endpoint so only your internal admin network/VPN can reach it.
If patching will take time, keep the endpoint blocked and continue log monitoring.

Patch

Upgrade Conarc iChannel to the vendor-fixed release(s) available for your deployment.
After upgrading, repeat the exposure check to ensure “/wc.dll?wwMaint~EditConfig” is no longer accessible in the vulnerable way.

What to monitor after changes

Monitor web server/reverse proxy logs for any attempts to access the blocked endpoint (spikes can indicate ongoing scanning).
If configuration changes or deletion occurred, confirm system health and restore any affected configuration from backups.

KEV/CISA note

This CVE is not listed in the CISA KEV catalog based on the provided findings.

Technical context

Severity is critical in practice because exploitation can lead to sensitive information disclosure, configuration modification, and denial of service (including configuration deletion). The mechanism is an unauthenticated request to a Conarc iChannel wc.dll maintenance/edit configuration endpoint (“/wc.dll?wwMaint~EditConfig”) that reaches an older West Wind Web Connection HTTP service path.

Exploitation status: a public exploit is available (1 known). KEV: not listed in CISA KEV. EPSS was predicted at 8.9% with a flat trend (note: this is prediction only and not a substitute for confirmed exploitation). The vendor’s primary mitigation is access restriction to the “/wc.dll?wwMaint~EditConfig” page. Because no authentication is required and no user interaction is needed, the key gating factor is whether the endpoint is reachable from untrusted networks.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.