CVE-2018-9866

Summary

A vulnerability in lack of validation of user-supplied parameters pass to XML-RPC calls on SonicWall Global Management System (GMS) virtual appliance's, allow remote user to execute arbitrary code. This vulnerability affected GMS version 8.1 and earlier.

Affected Software

Weaknesses

• CWE-77: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

ADP Enrichment

CVE Program Container

Additional References

• https://twitter.com/ddouhine/status/1019251292202586112
• https://github.com/rapid7/metasploit-framework/pull/10305
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0007

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: total

References

• https://twitter.com/ddouhine/status/1019251292202586112
• https://github.com/rapid7/metasploit-framework/pull/10305
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0007

• ←Previous
• Next→