CVE-2017-9640

This vulnerability is like a “trick the file location” bug. If someone is already logged in, they may be able to make the system write new (malicious) content into places it shouldn’t, potentially replacing files the server uses to run code.

This matters if your business runs Automated Logic Corporation WebCTRL, i-Vu, or SiteScan Web on a version earlier than 6.5. Exploitation requires valid user credentials, so it’s most relevant when admin or privileged accounts exist and could be abused. Reachability also depends on whether your environment exposes the application/admin functionality in a way that attackers can access; it’s not yet known from the available findings whether it’s reachable by default configuration.

Treat this as AMBER: the risk is elevated because directory-manipulation can let an authenticated attacker overwrite server files with executable content. Public exploitation exists, and interest/attention is rising, but this issue is not listed as confirmed by CISA KEV in the available information.