CVE-2018-3969

An exploitable vulnerability exists in the verified boot protection of the CUJO Smart Firewall

High · published March 21, 2019

CVSS v3.0
8.2
EPSS
1%
Percentile
41.7
In the wild
Unconfirmed
What it is

An exploitable vulnerability exists in the verified boot protection of the CUJO Smart Firewall. It is possible to add arbitrary shell commands into the dhcpd.conf file, that persist across reboots and firmware updates, and thus allow for executing unverified commands. To trigger this vulnerability, a local attacker needs to be able to write into /config/dhcpd.conf.

The record
Technical detail
CVSS v3.0
8.2 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00501 · 41.7th percentile
Published
2019-03-21T15:26Z
EPSS history
Timeline
  • 21 MAR 15:26Z
    An exploitable vulnerability exists in the verified boot protection of the CUJO Smart Firewall
    cvelistv5