CyberSec.Space Logo
Back to CVE Browser

CVE-2018-18555

CRITICAL
9.9
CVSS Severity Score
EPSS Score0.0870%
EPSS Percentile13.59th
PublishedDec 17, 2018
Last ModifiedNov 21, 2024

Vulnerability Description

A sandbox escape issue was discovered in VyOS 1.1.8. It provides a restricted management shell for operator users to administer the device. By issuing various shell special characters with certain commands, an authenticated operator user can break out of the management shell and gain access to the underlying Linux shell. The user can then run arbitrary operating system commands with the privileges afforded by their account.

Affected Platforms (CPE)

💻
Vyos

Vyos

= 1.1.8

References & Advisories

🔗 https://blog.vyos.io/the-operator-level-is-proved-insecure-and-will-be-removed-in-the-next-releases
🔗 https://blog.vyos.io/the-operator-level-is-proved-insecure-and-will-be-removed-in-the-next-releases

Related Vulnerabilities

CVE-2018-185569.9

A privilege escalation issue was discovered in VyOS 1.1.8. The default configuration also allows operator users to execute the ppp...

CVE-2019-58926.5

bgpd in FRRouting FRR (aka Free Range Routing) 2.x and 3.x before 3.0.4, 4.x before 4.0.1, 5.x before 5.0.2, and 6.x before 6.0.2 ...

CVE-2026-121917.8

A vulnerability was found in Comma AI Openpilot 0.11. This issue affects the function pickle.load/pickle.loads of the file selfdri...

CVE-2026-121905.3

A vulnerability has been found in Genspark AI Workspace App 2.8.4 on Android. This vulnerability affects unknown code of the compo...