CVE-2018-8306 Command injection in Microsoft Wireless Display Adapter V2 Software
Attackers can execute arbitrary commands on the Microsoft Wireless Display Adapter due to improper input management.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-8306?
CVE-2018-8306 is a medium-severity command injection vulnerability in Microsoft Wireless Display Adapter V2 Software, published on 11 Jul 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A command injection vulnerability exists in the Microsoft Wireless Display Adapter (MWDA) when the Microsoft Wireless Display Adapter does not properly manage user input, aka "Microsoft Wireless Display Adapter Command Injection Vulnerability." This affects Microsoft Wireless Display Adapter V2 Software.
Weakness: CWE-77
Which versions are affected by CVE-2018-8306?
It affects 1 product.
Products include Microsoft Wireless Display Adapter Firmware.
How do I fix CVE-2018-8306?
No fix has been published for CVE-2018-8306 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2018-8306 being exploited?
There is no known exploitation of CVE-2018-8306 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Wireless Display Adapter V2 Software
Sources
Also known as GHSA-m37p-x6xc-38vx.