CVE-2018-11066

critical-risk

Published 2018-11-26

Dell EMC Avamar Client Manager in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1, 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 and 2.2 contain a Remote Code Execution vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to execute arbitrary commands on the server.

Do I need to act?

41.0% chance of exploitation in next 30 days

EPSS score — higher than 59% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (20)

Emc Avamar

Emc Integrated Data Protection Appliance

Vsphere Data Protection

Affected Vendors

Vmware Dell

References (8)

Third Party Advisory http://www.securityfocus.com/bid/105968

Third Party Advisory http://www.securitytracker.com/id/1042153

Mailing List https://seclists.org/fulldisclosure/2018/Nov/49

Patch https://www.vmware.com/security/advisories/VMSA-2018-0029.html

Third Party Advisory http://www.securityfocus.com/bid/105968

Third Party Advisory http://www.securitytracker.com/id/1042153

Mailing List https://seclists.org/fulldisclosure/2018/Nov/49

Patch https://www.vmware.com/security/advisories/VMSA-2018-0029.html

/ 100

critical-risk

Severity 32/34 · Critical

Exploitability 17/34 · Moderate

Exposure 23/34 · High