Is CVE-2017-20241 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-20241 being exploited in the wild.

How severe is CVE-2017-20241?

Critical severity, with a CVSS score of 9.8, published 4 August 2026.

Which products and versions are affected?

Keysight Hawkeye before 6.0.7; Keysight IxByPass before 3.13.0.69; Keysight IxChariot Endpoint before 9.5.102 and before 10.0.254; Keysight IxProbe ; and 1 more.

Is there a fix for CVE-2017-20241?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2017-20241 attacked?

It is attacked over the network.

Am I affected by CVE-2017-20241?

Check whether you run Keysight Hawkeye, Keysight IxByPass, Keysight IxChariot Endpoint or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-20241: Keysight IxChariot Endpoint heap buffer overflow

CVE-2017-20241 · Severity: critical · CVSS 9.8 · Published 2026-08-04

Keysight IxChariot Endpoint is a network performance testing tool used by IT teams to measure and optimize application and network performance. An unauthenticated attacker can send a specially crafted network packet to trigger a heap buffer overflow, potentially crashing the endpoint service or executing arbitrary code to compromise systems and network infrastructure.

Technologies: Keysight Hawkeye, Keysight IxByPass, Keysight IxChariot Endpoint, Keysight IxProbe, Keysight IxTap. Vendors: Keysight.

Quick answers

Is CVE-2017-20241 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-20241 being exploited in the wild.
How severe is CVE-2017-20241?: Critical severity, with a CVSS score of 9.8, published 4 August 2026.
Which products and versions are affected?: Keysight Hawkeye before 6.0.7; Keysight IxByPass before 3.13.0.69; Keysight IxChariot Endpoint before 9.5.102 and before 10.0.254; Keysight IxProbe <UNKNOWN>; and 1 more.
Is there a fix for CVE-2017-20241?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2017-20241 attacked?: It is attacked over the network.
Am I affected by CVE-2017-20241?: Check whether you run Keysight Hawkeye, Keysight IxByPass, Keysight IxChariot Endpoint or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a heap-based buffer overflow in Keysight IxChariot Endpoint and related products (Hawkeye, IxTap, IxByPass, and IxProbe). An unauthenticated remote attacker can send a specially crafted packet over the network to trigger the overflow without requiring authentication. Successful exploitation allows arbitrary code execution with the privileges of the endpoint service, potentially leading to full system compromise. The vulnerability affects IxChariot Endpoint versions before 9.5.102 and 10.0.254; patches are available in version 9.5.102 and later.

Affected products

Keysight IxChariot Endpoint before 9.5.102 and before 10.0.254
Keysight Hawkeye before 6.0.7
Keysight IxByPass before 3.13.0.69
Keysight IxTap <UNKNOWN>
Keysight IxProbe <UNKNOWN>

Timeline

2026-08-04: disclosed: CISA advisory VA-26-216-01 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.