Unauthorized Command Execution in Citrix Xen Mobile by Low-Privileged Users

CVE-2018-18014

Summary

Citrix Xen Mobile 10.8 has a security flaw that allows low-privileged local users to execute system commands as root. This can be done by making requests to private services operating on ports 8000, 30000, and 30001 without proper authentication, thus threatening the integrity of the system. While the vendor asserts that the risk is mitigated by an internal firewall restricting access to configuration services, this vulnerability highlights potential security concerns regarding local access and command execution.

References