CVE-2018-4009

HIGH

Shimo VPN - Privilege Escalation via Improper Code Signing Validation

Title source: llm

Description

An exploitable privilege escalation vulnerability exists in the Shimo VPN helper service due to improper validation of code signing. A user with local access can use this vulnerability to raise their privileges to root. An attacker would need local access to the machine to successfully exploit this bug.

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://talosintelligence.com/vulnerability_reports/TALOS-2018-0678

Scores

CVSS v3 7.8

EPSS 0.0044

EPSS Percentile 35.0%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-494

Status published

Products (1)

shimovpn/shimo_vpn 4.1.5.1

Published Apr 15, 2019

Tracked Since Feb 18, 2026