PT-2018-10312 · Openwrt · Openwrt

Published 2018-06-19 · Updated 2024-08-05 · CVE-2018-11116

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenWrt (affected versions not specified)

Description The issue concerns the mishandling of access control in certain configuration files, potentially allowing remote authenticated users to call arbitrary methods, which could lead to remote Information Disclosure or Code Execution. This is demonstrated by access to the file, log, and service namespaces. However, it's noted that the developer disputes this as a vulnerability, stating that the functionality operates as intended.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2018-11116

Affected Products

Openwrt

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-11116 · Security Note
• http://blog.hac425.top/2018/05/16/openwrt_rpcd_acl_fail.html · Note
• https://forum.openwrt.org/t/rpcd-vulnerability-reported-on-vultdb/16497/3 · Note