CVE-2018-1185

MEDIUM

EMC RecoverPoint <5.1.1, 5.0.1.3 - Command Injection

Title source: llm
STIX 2.1

Description

An issue was discovered in EMC RecoverPoint for Virtual Machines versions prior to 5.1.1, EMC RecoverPoint version 5.1.0.0, and EMC RecoverPoint versions prior to 5.0.1.3. Command injection vulnerability in Admin CLI may allow a malicious user with admin privileges to escape from the restricted shell to an interactive shell and run arbitrary commands with root privileges.

Exploits (1)

exploitdb WORKING POC
by Paul Taylor · textlocalwindows
https://www.exploit-db.com/exploits/44614

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1040320
Mailing List, Patch, Third Party Advisory x_refsource_confirm
http://seclists.org/fulldisclosure/2018/Feb/9
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/44614/

Scores

CVSS v3 6.7
EPSS 0.0131
EPSS Percentile 79.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (3)
dell/emc_recoverpoint 5.1.0.0
dell/emc_recoverpoint < 5.0.1.3
dell/emc_recoverpoint_for_virtual_machines < 5.1.1
Published Feb 03, 2018
Tracked Since Feb 18, 2026