RCE in Dell EMC Scaleio
CVE-2018-1238
Dell EMC ScaleIO versions prior to 2.5, contain a command injection vulnerability in the Light Installation Agent (LIA). This component is used for central management of ScaleIO deployment and uses shell commands for certain actions. A remote malicious user, with network access to LIA and knowledge of the LIA administrative password, could potentially exploit this vulnerability to run arbitrary commands as root on the systems where LIAs are installed.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.015 (73.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 73rd percentile — 73.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: 0.000
Affected products
- Dell EMC Scaleio
- Dell EMC Scaleio — versions versions prior to 2.5
Weakness classification (CWE)
References
- seclists.org/fulldisclosure/2018/Mar/59 (mailing-list, Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2018-1238?
- CVE-2018-1238 is a high-severity vulnerability in Dell EMC Scaleio, classified under OS Command Injection. CVSS score: 7.5/10. Published 2018-03-27.
- How severe is CVE-2018-1238?
- High severity. CVSS v3 base score is 7.5 out of 10.