CVE-2018-7281

CactusVPN 5.3.6 for macOS contains a root privilege escalation vulnerability through a setuid root binary called runme

published February 21, 2018

CVSS
—
EPSS
2%
Percentile
74.6
In the wild
Unconfirmed
What it is

CactusVPN 5.3.6 for macOS contains a root privilege escalation vulnerability through a setuid root binary called runme. The binary takes a single command line argument and passes this argument to a system() call, thus allowing low privileged users to execute commands as root.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01541 · 74.6th percentile
Published
2018-02-21T22:00Z
EPSS history
Timeline
  • 21 FEB 22:00Z
    CactusVPN 5.3.6 for macOS contains a root privilege escalation vulnerability through a setuid root binary called runme
    cvelistv5