CVE-2018-11078

low-risk

Published 2018-09-11

Dell EMC VPlex GeoSynchrony, versions prior to 6.1, contains an Insecure File Permissions vulnerability. A remote authenticated malicious user could read from VPN configuration files on and potentially author a MITM attack on the VPN traffic.

Do I need to act?

0.10% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.0/10 Medium

ADJACENT_NETWORK / HIGH complexity

Affected Products (1)

Emc Vplex Geosynchrony

Affected Vendors

Dell

References (4)

Third Party Advisory http://www.securitytracker.com/id/1041613

Mailing List https://seclists.org/fulldisclosure/2018/Sep/10

Third Party Advisory http://www.securitytracker.com/id/1041613

Mailing List https://seclists.org/fulldisclosure/2018/Sep/10

/ 100

low-risk

Severity 10/34 · Low

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal