CVE-2018-18555: OS Command Injection
A sandbox escape issue was discovered in VyOS 1.1.8. It provides a restricted management shell for operator users to administer the device. By issuing various shell special characters with certain commands, an authenticated operator user can break out of the management shell and gain access to the underlying Linux shell. The user can then run arbitrary operating system commands with the privileges afforded by their account.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-18555?
CVE-2018-18555 is classified as a high severity vulnerability due to its potential for unauthorized system access.
How do I fix CVE-2018-18555?
To fix CVE-2018-18555, upgrade to VyOS version later than 1.1.8 where this sandbox escape issue is addressed.
Who is affected by CVE-2018-18555?
CVE-2018-18555 affects users of VyOS version 1.1.8 who utilize the restricted management shell feature.
What kind of impact does CVE-2018-18555 have on system security?
CVE-2018-18555 allows authenticated users to escape the management shell, leading to potential unauthorized access and control of the system.
Is CVE-2018-18555 exploitable by unauthenticated users?
No, CVE-2018-18555 requires authentication as an operator user to exploit the sandbox escape vulnerability.