CVE-2017-6526

Think of dnaLIMS like a building’s front desk. This flaw is like leaving a hidden “back office door” unlocked—and it lets the wrong person walk in and give the system instructions. If someone can reach that door from the internet, they can potentially take over the server and cause outages or steal data.

This matters to you if you run dnaTools dnaLIMS version 4-2015s13. Because the command execution is unauthenticated, it becomes a real risk when an attacker can reach the vulnerable administrative web shell endpoint over the network (for example, from the public internet).

This is RED urgent because attackers have a publicly available way to exploit it without needing a login. With command execution and full server impact possible, you should prioritize patching/upgrading immediately over normal maintenance work.

1. Confirm exposure

   • Identify the exact dnaTools dnaLIMS version currently installed (confirm it’s 4-2015s13).
   • Confirm whether your dnaLIMS web/admin functionality is reachable from the internet (for example, is it behind a public-facing URL/port).

2. Determine the fixed version

   • The vendor remediation indicates “update to a later version.” Use your vendor’s release notes/support to identify the specific fixed branch/release for dnaTools dnaLIMS.
   • If you have multiple environments (prod/staging), patch production first or in lockstep if downtime windows allow.

3. Upgrade

   • Upgrade dnaTools dnaLIMS from 4-2015s13 to the vendor’s later fixed release.
   • Validate after upgrade: verify the application/admin pages work normally and that the server is reachable only through intended networks.

4. Temporary containment if you cannot upgrade immediately

   • Restrict access to the dnaLIMS web/admin endpoints so they are not reachable from the public internet (allow only trusted IPs/VPN/subnets).
   • If there is a reverse proxy or firewall in front of dnaLIMS, enforce rules to block direct access to the administrative CGI endpoint.

5. Check for signs of exploitation

   • Review logs around the period of exposure for suspicious POST requests targeting the administrative CGI endpoint (sysAdmin.cgi).
   • Look for unusual command/response patterns, authentication bypass attempts (even if none are required), and unexpected changes in system behavior.

6. What to monitor after remediation

   • Continue monitoring for repeated requests to the administrative CGI path.
   • Monitor server health and unexpected process/network activity that could indicate compromise.

7. CISA due date (KEV)

   • KEV is not listed in CISA KEV for this issue, so no KEV-specific deadline is available from the provided findings.

Severity is critical (command execution with no authentication required). The weakness is CWE-287 (Improper Authentication). The attack vector is remote: attackers can send POST requests to an improperly protected administrative web shell (cgi-bin/dna/sysAdmin.cgi), resulting in unauthenticated command execution.

Exploitation status: public exploit availability is indicated (2 known), and press attention is rising, which aligns with the RED urgency. KEV is not listed in CISA KEV, so there is no KEV-driven confirmation in the provided findings. EPSS is provided as a prediction, but public blocks should not rely on it when exploitation indicators are stronger.

What KEV means here: since it’s not in KEV for this CVE per the findings, there’s no CISA “known exploited” confirmation attached to this specific issue in the provided material.