CVE-2018-4008

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-04-15 · updated 2026-06-17
Weakness: CWE-269

Description

An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the RunVpncScript command. The command takes a user-supplied script argument and executes it under root context. A user with local access can use this vulnerability to raise their privileges to root. An attacker would need local access to the machine to successfully exploit this bug.

Affected products

Shimo VPN: 4.1.5.1

References

https://talosintelligence.com/vulnerability_reports/TALOS-2018-0677
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0677

Get alerted when CVE-2018-4008 or the next vulnerability affects your stack