CVEvulnerability

CVE-2018-18555

9.9 CRITICAL Published 2018-12-17 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-12-17
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.9 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0 ([email protected])
9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
Weaknesses
CWE-78

Description

A sandbox escape issue was discovered in VyOS 1.1.8. It provides a restricted management shell for operator users to administer the device. By issuing various shell special characters with certain commands, an authenticated operator user can break out of the management shell and gain access to the underlying Linux shell. The user can then run arbitrary operating system commands with the privileges afforded by their account.

Affected configurations

• vyos vyos 1.1.8

Related

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References