VULNERABILITY INTELLIGENCE

CVE-2018-3881

CVSS score9.4 CRITICAL

EPSS probability1.23%

CISA KEVNot currently listed

Published2018-08-01

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

Description

An exploitable unauthenticated XML external injection vulnerability was identified in FocalScope v2416. A unauthenticated attacker could submit a specially crafted web request to FocalScope's server that could cause an XXE, and potentially result in data compromise.

Weakness classification

CWE-611: Improper Restriction of XML External Entity Reference

Primary references

talos-cna@cisco.com — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory