CVE-2017-20242: Keysight IxChariot Buffer Overflow Flaw

CVE-2017-20242 Overview

CVE-2017-20242 is a stack-based buffer overflow [CWE-121] in Keysight IxChariot Endpoint versions before 9.5.102. An unauthenticated remote attacker can send a specially crafted packet to the endpoint to trigger the overflow. Successful exploitation crashes the endpoint or allows arbitrary code execution in the context of the vulnerable process. IxChariot is used to assess network performance across production and test environments, so exposed endpoints frequently sit on reachable network segments.

Critical Impact
An unauthenticated network attacker can achieve remote code execution or denial of service against IxChariot Endpoint hosts by delivering a single malformed packet.

Affected Products

Keysight IxChariot Endpoint versions prior to 9.5.102
Deployments running the IxChariot Endpoint agent on Windows and Linux hosts used for performance testing
Any network segment where the IxChariot Endpoint listener is reachable by untrusted clients

Discovery Timeline

2026-08-04 - CVE-2017-20242 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2017-20242

Vulnerability Analysis

The flaw is a classic stack-based buffer overflow in the IxChariot Endpoint packet-handling path. The endpoint listens on the network for control and measurement traffic. When it parses an attacker-supplied packet, a fixed-size stack buffer receives data whose length is derived from attacker-controlled fields without proper bounds checking. Writing past the buffer overwrites adjacent stack data, including the saved return address and any stack cookies that may be absent or bypassable.

Because the listener does not require authentication, exploitation requires only network reachability to the endpoint. The vulnerability affects confidentiality, integrity, and availability: an attacker who lands controlled data on the stack can redirect execution flow, while a malformed packet alone reliably crashes the service.

Root Cause

The root cause is missing input validation on the size of a data field copied into a fixed-length stack buffer during packet parsing. This maps to CWE-121: Stack-based Buffer Overflow. The parser trusts a length or terminator supplied by the peer instead of enforcing the buffer's actual capacity.

Attack Vector

Exploitation is remote and unauthenticated over the network. An attacker sends a single specially crafted packet to the IxChariot Endpoint service. No user interaction is required. Impact ranges from a process crash to arbitrary code execution in the security context of the endpoint process. Refer to the Keysight Security Advisory and the CISA CSAF Document for advisory details.

No public proof-of-concept exploit code is available at time of publication. See the CVE-2017-20242 Record for reference metadata.

Detection Methods for CVE-2017-20242

Indicators of Compromise

Unexpected termination or repeated restarts of the IxChariot Endpoint process on test hosts
Crash dumps referencing stack corruption in IxChariot Endpoint binaries
Inbound traffic to IxChariot Endpoint listener ports from hosts outside the designated test network
Anomalous child processes spawned by the IxChariot Endpoint service

Detection Strategies

Deploy network intrusion detection signatures that flag oversized or malformed packets directed at IxChariot Endpoint listener ports
Monitor endpoint telemetry for process crashes, unexpected memory access violations, or code execution originating from the IxChariot Endpoint service
Correlate outbound connections from IxChariot Endpoint hosts against known-good performance-test destinations to identify post-exploitation callbacks

Monitoring Recommendations

Enable Windows Error Reporting or Linux coredump collection for the IxChariot Endpoint process and forward events to a central log store
Alert on any inbound connection to IxChariot Endpoint hosts sourced from user, guest, or internet-facing segments
Track process ancestry so that shells, scripting hosts, or download utilities spawned by the endpoint service generate high-priority alerts

How to Mitigate CVE-2017-20242

Immediate Actions Required

Upgrade all IxChariot Endpoint installations to version 9.5.102 or later
Inventory all hosts running the IxChariot Endpoint agent and confirm patch status
Restrict inbound access to IxChariot Endpoint listener ports to trusted test controllers only
Isolate performance-testing infrastructure from production and user network segments

Patch Information

Keysight has released a fixed build. Install IxChariot Endpoint 9.5.102 or a later release on every affected host. Consult the Keysight Security Advisory for exact download locations and platform-specific packages.

Workarounds

Block the IxChariot Endpoint listener ports at host and network firewalls except for allow-listed controller IP addresses
Stop and disable the IxChariot Endpoint service on hosts where performance testing is not actively running
Place IxChariot Endpoint hosts inside a dedicated management VLAN with strict ingress filtering
Require VPN or bastion access before test operators can reach endpoint agents

bash

# Configuration example: restrict IxChariot Endpoint access to a trusted controller subnet
# Replace 10.10.20.0/24 with the address range of your IxChariot controllers

# Linux (iptables)
iptables -A INPUT -p tcp --dport 10115 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 10115 -j DROP
iptables -A INPUT -p tcp --dport 10116 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 10116 -j DROP

# Windows (PowerShell)
New-NetFirewallRule -DisplayName "IxChariot-Allow-Controllers" \
  -Direction Inbound -Protocol TCP -LocalPort 10115,10116 \
  -RemoteAddress 10.10.20.0/24 -Action Allow
New-NetFirewallRule -DisplayName "IxChariot-Block-All" \
  -Direction Inbound -Protocol TCP -LocalPort 10115,10116 \
  -Action Block