VULNERABILITY INTELLIGENCE

CVE-2018-4008

CVSS score7.8 HIGH
EPSS probability0.42%
CISA KEVNot currently listed
Published2019-04-15
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the RunVpncScript command. The command takes a user-supplied script argument and executes it under root context. A user with local access can use this vulnerability to raise their privileges to root. An attacker would need local access to the machine to successfully exploit this bug.

Weakness classification

  • CWE-269: Improper Privilege Management

Primary references