Command Injection Vulnerability in Norton Core Router
CVE-2018-5234

8HIGH

Key Information:

Vendor

Symantec Corporation

Status
Norton Core
Vendor
CVE Published:
30 April 2018

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 22%

What is CVE-2018-5234?

The Norton Core router, versions prior to v237, is vulnerable to a command injection exploit. This vulnerability allows attackers to execute arbitrary commands on the device, potentially compromising its integrity and security. By exploiting this weakness, an attacker could gain access to sensitive data or control over the router, highlighting the importance of timely updates and security measures for affected users.

Affected Version(s)

Norton Core Prior to v237

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

ble_norton_core
Created by embedi

References

https://www.symantec.com/security_response/securityupdate...
x_refsource_CONFIRM
https://www.exploit-db.com/exploits/44574/
exploitx_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/103955
vdb-entryx_refsource_BID

EPSS Score

22% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.