CVE-2018-18555 Command injection in n/a
Authenticated operator users can escape the restricted management shell to execute arbitrary Linux commands, potentially escalating privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-18555?
CVE-2018-18555 is a critical command injection vulnerability in n/a, published on 17 Dec 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A sandbox escape issue was discovered in VyOS 1.1.8. It provides a restricted management shell for operator users to administer the device. By issuing various shell special characters with certain commands, an authenticated operator user can break out of the management shell and gain access to the underlying Linux shell. The user can then run arbitrary operating system commands with the privileges afforded by their account.
Weakness: CWE-78
Which versions are affected by CVE-2018-18555?
It affects 1 product.
Products include Vyos Vyos.
How do I fix CVE-2018-18555?
No fix has been published for CVE-2018-18555 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2018-18555 being exploited?
There is no known exploitation of CVE-2018-18555 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-2m72-4x6w-fqpx.