CVE-2017-15093 - CVE House
Back to Database
Status published Medium CVE-2017-15093

When api-config-dir is set to a non-empty value, which is...

Vulnerability Description

When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4 allows an authorized user to update the Recursor's ACL by adding and removing netmasks, and to configure forward zones. It was discovered that the new netmask and IP addresses of forwarded zones were not sufficiently validated, allowing an authenticated user to inject new configuration directives into the Recursor's configuration.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-15093

Credits & Attribution

No credits recorded in the NVD database.

References

More from PowerDNS

View All →
CVE-2025-59030
Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor
High 7.5
CVE-2025-59029
Internal logic flaw in cache management can lead to a denial of service in PowerDNS Recursor
Medium 5.3
CVE-2025-59024
Crafted delegations or IP fragments can poison cached delegations in Recursor
Medium 6.5
CVE-2025-59023
Crafted delegations or IP fragments can poison cached delegations in Recursor
High 8.2
CVE-2025-30195
A crafted zone can lead to an illegal memory access in the PowerDNS Recursor
High 7.5

Affected Vendor

Affected Software

PowerDNS Recursor
Vulnerable Versions:
4.x up to and including 4.0.6, 3.x up to and including 3.7.4

Timeline

Official Publish: January 23rd, 2018
Last Modified: September 17th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-20

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact