CVE-2018-6892
CRITICALCloudme Sync < 1.10.9 - Memory Corruption
Title source: ruleDescription
An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sync" client application listening on port 8888 can send a malicious payload causing a buffer overflow condition. This will result in an attacker controlling the program's execution flow and allowing arbitrary code execution.
Exploits (9)
nomisec
WORKING POC
1 stars
by latortuga71 · poc
https://github.com/latortuga71/CVE-2018-6892-Golang
nomisec
WORKING POC
by manojcode · poc
https://github.com/manojcode/CloudMe-Sync-1.10.9---Buffer-Overflow-SEH-DEP-Bypass
nomisec
WORKING POC
by manojcode · poc
https://github.com/manojcode/-Win10-x64-CloudMe-Sync-1.10.9-Buffer-Overflow-SEH-DEP-Bypass
metasploit
WORKING POC
GREAT
by hyp3rlinx, Daniel Teixeira · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/cloudme_sync.rb
exploitdb
WORKING POC
VERIFIED
by hyp3rlinx · pythonremotewindows
https://www.exploit-db.com/exploits/44027
exploitdb
WORKING POC
by Raymond Wellnitz · rubyremotewindows_x86-64
https://www.exploit-db.com/exploits/45197
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/44175
exploitdb
WORKING POC
by Matteo Malvica · pythonremotewindows_x86-64
https://www.exploit-db.com/exploits/46250
References (10)
Scores
CVSS v3
9.8
EPSS
0.8967
EPSS Percentile
99.6%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Classification
CWE
CWE-119
Status
published
Affected Products (1)
cloudme/sync
< 1.10.9
Timeline
Published
Feb 11, 2018
Tracked Since
Feb 18, 2026