CVE-2017-17736 in Kentico
Summary
by MITRE
Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 12/19/2025
CVE-2017-17736 represents a critical authentication bypass vulnerability affecting Kentico content management systems version 9.0 prior to 9.0.51 and version 10.0 prior to 10.0.48. This vulnerability resides in the installation and setup process of the CMS, specifically within the CMSInstall/install.aspx endpoint which remains accessible even after initial system configuration. The flaw allows remote attackers to gain unrestricted administrative privileges by simply navigating to the installation page and subsequently accessing the administration dashboard without proper authentication mechanisms being enforced.
The technical nature of this vulnerability stems from improper access control implementation during the CMS installation phase. When Kentico systems are installed or upgraded, the installation wizard remains accessible to unauthorized users who can exploit the lack of authentication checks on the install.aspx page. This creates an attack surface where malicious actors can bypass normal authentication procedures by leveraging the installation interface to establish administrative access. The vulnerability is classified under CWE-285 which deals with improper authorization in authentication mechanisms, specifically highlighting the absence of proper access controls during system setup processes.
The operational impact of this vulnerability is severe as it provides attackers with complete control over affected systems. Global administrator access enables unauthorized users to modify all system configurations, access sensitive data, create or modify user accounts, and potentially establish persistent backdoors. This level of access can lead to complete system compromise, data exfiltration, and disruption of business operations. The vulnerability affects organizations using Kentico versions that have not been patched, creating widespread exposure across various industries including healthcare, finance, and government sectors that rely on content management systems for their digital infrastructure.
Organizations should immediately apply the vendor patches released for versions 9.0.51 and 10.0.48 to remediate this vulnerability. Additional mitigations include implementing network segmentation to restrict access to installation endpoints, ensuring that the CMS installation directory is not accessible from external networks, and conducting regular security assessments to identify unauthorized access points. According to ATT&CK framework, this vulnerability maps to T1078 which covers valid accounts and T1543 which deals with create or modify system process. Security teams should monitor for suspicious access patterns and implement network monitoring solutions to detect exploitation attempts. Organizations should also review their access control policies and ensure that system administrators follow secure configuration practices to prevent unauthorized access to installation interfaces. The vulnerability demonstrates the critical importance of proper access control implementation during system setup phases and highlights the need for comprehensive security testing of all system interfaces including installation and configuration components.