What is CVE-2018-0438?

CVE-2018-0438 is a high-severity vulnerability in Cisco Umbrella, classified under Improper Input Validation. CVSS score: 7.8/10. Published 2018-10-05.

How severe is CVE-2018-0438?

High severity. CVSS v3 base score is 7.8 out of 10.

Privilege escalation in Cisco Umbrella

CVE-2018-0438

A vulnerability in the Cisco Umbrella Enterprise Roaming Client (ERC) could allow an authenticated, local attacker to elevate privileges to Administrator. To exploit the vulnerability, the attacker must authenticate with valid local user c…

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.014 (69.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Cisco Umbrella — versions n/a
Cisco Umbrella_enterprise_roaming_client
Microsoft Windows

Weakness classification (CWE)

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
psirt@cisco.com (VDB Entry, Third Party Advisory, exploit, x_refsource_EXPLOIT-DB)

Frequently asked questions

What is CVE-2018-0438?: CVE-2018-0438 is a high-severity vulnerability in Cisco Umbrella, classified under Improper Input Validation. CVSS score: 7.8/10. Published 2018-10-05.
How severe is CVE-2018-0438?: High severity. CVSS v3 base score is 7.8 out of 10.