Skip to content
Fencer Vulns
critical 9.9

CVE-2018-18556 in the critical feed json

A privilege escalation issue was discovered in VyOS 1.1.8.

published 2018-12-17 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-10276

cvss
9.9
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
15.4%
EPSS 15.4% chance of exploitation in 30 days, percentile 96%
public exploits
1
Metasploit

Summary

A privilege escalation issue was discovered in VyOS 1.1.8. The default configuration also allows operator users to execute the pppd binary with elevated (sudo) permissions. Certain input parameters are not properly validated. A malicious operator user can run the binary with elevated permissions and leverage its improper input validation condition to spawn an attacker-controlled shell with root privileges.

Timeline

  1. First public exploit (Metasploit exploit/linux/ssh/vyos_restricted_shell_privesc)
  2. Published

Exploit prediction

15.41% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/linux/ssh/vyos_restricted_shell_privesc VyOS restricted-shell Escape and Privilege Escalation metasploit exploit, great rank, 2018-11-05
  • blog.vyos.io https://blog.vyos.io/the-operator-level-is-proved-insecure-and-will-be-removed-in-the-next-releases referenced PoC, tagged "exploit" by a source, unverified
  • blog.mirch.io https://blog.mirch.io/2018/11/05/cve-2018-18556-vyos-privilege-escalation-via-sudo-pppd-for-operator-users/ referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/159234/VyOS-restricted-shell-Escape-Privilege-Escalation.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD 2.0 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.