CVE-2018-17495 Privilege escalation in eVisitorPass

High 8.4 Published 19 Mar 2019 Updated 17 Sep 2024

A local attacker can escape the kiosk mode in eVisitorPass to access the terminal and execute arbitrary commands with elevated privileges.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-17495?

CVE-2018-17495 is a high-severity vulnerability in eVisitorPass, published on 19 Mar 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error with the Virtual Keyboard Help Dialog. By visiting the kiosk and removing the program from fullscreen, an attacker could exploit this vulnerability using the terminal to launch the command prompt.

Which versions are affected by CVE-2018-17495?

It affects 1 product.

Products include Thresholdsecurity Evisitorpass.

How do I fix CVE-2018-17495?

No fix has been published for CVE-2018-17495 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-17495 being exploited?

There is no known exploitation of CVE-2018-17495 in the wild and no public exploit code.

Sources

Also known as GHSA-jpgr-988q-78px.