PT-2019-10747 · Feingeist Software Gmbh · Shimo Vpn

Published 2019-04-17 · Updated 2023-02-02 · CVE-2018-4007

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Shimo VPN version 4.1.5.1

Description A privilege escalation issue exists in the helper service of Shimo VPN, specifically in the deleteConfig functionality, allowing the program to delete any protected file on the system. An attacker would need local access to the machine to exploit this issue.

Recommendations For Shimo VPN version 4.1.5.1, consider restricting access to the deleteConfig functionality in the helper service until a patch is available. As a temporary workaround, limit local access to the machine to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-4007

Affected Products

Shimo Vpn

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0676 · Exploit
• https://osv.dev/vulnerability/CVE-2018-4007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-4007 · Security Note
• https://t.me/cvenotify/43400 · Telegram Post