CVE-2011-4182CWE-77

shell code injection via ESSID because of missing escaping of a variable

High · published June 12, 2018

CVSS v3.0
7.3
EPSS
2%
Percentile
77.6
In the wild
Unconfirmed
What it is

Missing escaping of ESSID values in sysconfig of SUSE Linux Enterprise allows attackers controlling an access point to cause execute arbitrary code. Affected releases are sysconfig prior to 0.83.7-2.1.

The record
Technical detail
CVSS v3.0
7.3 · HIGH
Vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01757 · 77.6th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2018-06-12T15:00Z
EPSS history
Timeline
  • 12 JUN 15:00Z
    shell code injection via ESSID because of missing escaping of a variable
    cvelistv5