CVE-2018-5547 Privilege escalation in BIG-IP APM client for Windows
Unprivileged users can escalate to administrator privileges via the Windows Logon Integration certificate dialog in F5 BIG-IP APM client.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-5547?
CVE-2018-5547 is a high-severity vulnerability in F5 Networks, Inc. BIG-IP APM client for Windows, published on 17 Aug 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7.1.7.1 for Windows by default uses Legacy logon mode which uses a SYSTEM account to establish network access. This feature displays a certificate user interface dialog box which contains the link to the certificate policy. By clicking on the link, unprivileged users can open additional dialog boxes and get access to the local machine windows explorer which can be used to get administrator privilege. Windows Logon Integration is vulnerable when the APM client is installed by an administrator on a user machine. Users accessing the local machine can get administrator privileges
Weakness: CWE-862
Which versions are affected by CVE-2018-5547?
It affects 1 product.
Products include F5 Big-Ip Access Policy Manager Client.
How do I fix CVE-2018-5547?
No fix has been published for CVE-2018-5547 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-5547 being exploited?
There is no known exploitation of CVE-2018-5547 in the wild and no public exploit code.
Sources
Also known as GHSA-m3rp-fqh4-whc7.