CVE-2017-15524

CRITICAL 9.1CVE-2017-15524 · Published 19/12/2017 · updated 17/06/2026

In short

CVE-2017-15524 is a CRITICAL (CVSS 9.1) vulnerability affecting web application firewall (kemptechnologies).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 68.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
web application firewall kemptechnologies	`≤ 7.2.40`	No fix yet

Description

The Application Firewall Pack (AFP, aka Web Application Firewall) component on Kemp Load Balancer devices with software before 7.2.40.1 allows a Security Feature Bypass via an HTTP POST request.

References

securityfocus.com/archive/1/541602/100/0/threaded
kemptechnologies.com/files/assets/documentation/7.2/release-notes/Release_Notes-LoadMaster.pdf · Issue Tracking
pallas.com/advisories/cve_2017_15524_kemp_afp_waf_bug_on_post_data · Exploit

More vulnerabilities in web application firewall

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free