{"api_version":"1","generated_at":"2026-07-24T18:25:09+00:00","cve":"CVE-2018-18556","urls":{"html":"https://cve.report/CVE-2018-18556","api":"https://cve.report/api/cve/CVE-2018-18556.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-18556","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-18556"},"summary":{"title":"CVE-2018-18556","description":"A privilege escalation issue was discovered in VyOS 1.1.8. The default configuration also allows operator users to execute the pppd binary with elevated (sudo) permissions. Certain input parameters are not properly validated. A malicious operator user can run the binary with elevated permissions and leverage its improper input validation condition to spawn an attacker-controlled shell with root privileges.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2018-12-17 19:29:00","updated_at":"2023-01-20 15:28:00"},"problem_types":["NVD-CWE-noinfo"],"metrics":[],"references":[{"url":"http://packetstormsecurity.com/files/159234/VyOS-restricted-shell-Escape-Privilege-Escalation.html","name":"http://packetstormsecurity.com/files/159234/VyOS-restricted-shell-Escape-Privilege-Escalation.html","refsource":"MISC","tags":[],"title":"VyOS restricted-shell Escape / Privilege Escalation ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://blog.mirch.io/2018/11/05/cve-2018-18556-vyos-privilege-escalation-via-sudo-pppd-for-operator-users/","name":"https://blog.mirch.io/2018/11/05/cve-2018-18556-vyos-privilege-escalation-via-sudo-pppd-for-operator-users/","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"CVE-2018-18556 – VyOS Privilege escalation via sudo pppd  for operator users – Rich Mirch","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://blog.vyos.io/the-operator-level-is-proved-insecure-and-will-be-removed-in-the-next-releases","name":"https://blog.vyos.io/the-operator-level-is-proved-insecure-and-will-be-removed-in-the-next-releases","refsource":"CONFIRM","tags":["Exploit","Vendor Advisory"],"title":"The \"operator\" level is proved insecure and will be removed in the next releases","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-18556","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-18556","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"18556","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"vyos","cpe5":"vyos","cpe6":"1.1.8","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"18556","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"vyos","cpe5":"vyos","cpe6":"1.1.8","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2018-18556","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A privilege escalation issue was discovered in VyOS 1.1.8. The default configuration also allows operator users to execute the pppd binary with elevated (sudo) permissions. Certain input parameters are not properly validated. A malicious operator user can run the binary with elevated permissions and leverage its improper input validation condition to spawn an attacker-controlled shell with root privileges."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://blog.vyos.io/the-operator-level-is-proved-insecure-and-will-be-removed-in-the-next-releases","refsource":"CONFIRM","url":"https://blog.vyos.io/the-operator-level-is-proved-insecure-and-will-be-removed-in-the-next-releases"},{"name":"https://blog.mirch.io/2018/11/05/cve-2018-18556-vyos-privilege-escalation-via-sudo-pppd-for-operator-users/","refsource":"MISC","url":"https://blog.mirch.io/2018/11/05/cve-2018-18556-vyos-privilege-escalation-via-sudo-pppd-for-operator-users/"},{"refsource":"MISC","name":"http://packetstormsecurity.com/files/159234/VyOS-restricted-shell-Escape-Privilege-Escalation.html","url":"http://packetstormsecurity.com/files/159234/VyOS-restricted-shell-Escape-Privilege-Escalation.html"}]}},"nvd":{"publishedDate":"2018-12-17 19:29:00","lastModifiedDate":"2023-01-20 15:28:00","problem_types":["NVD-CWE-noinfo"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.1,"impactScore":6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE","baseScore":9},"severity":"HIGH","exploitabilityScore":8,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:vyos:vyos:1.1.8:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"18556","Ordinal":"135474","Title":"CVE-2018-18556","CVE":"CVE-2018-18556","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"18556","Ordinal":"1","NoteData":"A privilege escalation issue was discovered in VyOS 1.1.8. The default configuration also allows operator users to execute the pppd binary with elevated (sudo) permissions. Certain input parameters are not properly validated. A malicious operator user can run the binary with elevated permissions and leverage its improper input validation condition to spawn an attacker-controlled shell with root privileges.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"18556","Ordinal":"2","NoteData":"2018-12-17","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"18556","Ordinal":"3","NoteData":"2020-09-21","Type":"Other","Title":"Modified"}]}}}