CVE-2018-1111highCWE-77

CVE-2018-1111

78Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 7.5epss 98%

from disclosure to weapon0 days

Published on NVDMay 17

1st PoCMay 17

metasploitMay 15

exploitation probability

98%top 1% of all CVEs

observed exploitation

nono source reports it

7 public exploit(s)

DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.

CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Fedora · dhcp Red Hat · dhcp

public PoCs found — 7✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/44652 exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/44890 githubgithub.com/knqyf263/CVE-2018-1111★ 13 githubgithub.com/kkirsche/CVE-2018-1111★ 12 githubgithub.com/baldassarreFe/FEP3370-advanced-ethical-hacking★ 0 cve_referencewww.exploit-db.com/exploits/44652/unverified cve_referencewww.exploit-db.com/exploits/44890/unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References