CVE-2018-25159
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2018-25159 is a critical-severity Unauthorized Error Injection Can Degrade Hardware Redundancy (CWE-1334) vulnerability. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2018-25159 is an object-graph navigation language (OGNL) injection vulnerability in the Epross AVCON6 systems management platform. It enables unauthenticated attackers to execute arbitrary commands by injecting malicious OGNL expressions into crafted requests targeting the login.action endpoint, specifically via the redirect parameter. This allows instantiation of ProcessBuilder objects to run system commands with root privileges. The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-1334.
Unauthenticated remote attackers can exploit the vulnerability with low complexity and no user interaction required. By sending HTTP requests containing OGNL payloads in the redirect parameter to login.action, they achieve remote code execution, gaining full control over the system including high confidentiality, integrity, and availability impacts through root-level command execution.
Advisories and related resources, including the VulnCheck advisory at https://www.vulncheck.com/advisories/epross-avcon6-ognl-remote-code-execution-via-login-action and a proof-of-concept exploit at https://www.exploit-db.com/exploits/47379, provide further technical details on the vulnerability. No specific patches or mitigations are detailed in the provided information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-21653
Vulnerability Data
Epross AVCON6 systems management platform contains an object-graph navigation language (OGNL) injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by injecting malicious OGNL expressions. Attackers can send crafted requests to the login.action endpoint with OGNL payloads in the…
more
redirect parameter to instantiate ProcessBuilder objects and execute system commands with root privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated OGNL injection in a public-facing web login endpoint (login.action), enabling remote code execution via crafted HTTP requests, directly mapping to exploitation of public-facing applications.
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents OGNL injection by requiring validation of untrusted inputs like the redirect parameter in login.action to block malicious expressions.
Requires timely remediation of the specific OGNL injection flaw through patching, eliminating the root cause of unauthenticated RCE.
Boundary protection at web interfaces can deploy web application firewalls to inspect and block crafted HTTP requests containing OGNL payloads.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Authenticating hardware and services directly blocks unauthorized agents from reaching redundant blocks.
Least-privilege access controls on hardware limit the ability of unauthorized agents to inject errors.
Hardware monitoring can detect injected errors after the fact but does not prevent unauthorized injection into redundancy mechanisms.
Physical-access controls reduce the attack surface for hardware tampering but do not address logical or remote error injection.
Resilience mechanisms can maintain function despite degraded redundancy but do not stop the injection itself.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Managing access rights restricts privileges that could be abused to inject faults into redundant components.
Restricting privileged access rights limits the ability of insiders or compromised accounts to tamper with redundancy mechanisms.
Access control limits who can reach redundant hardware blocks, reducing the chance of unauthorized error injection.
Redundancy of information processing facilities directly addresses the loss of hardware redundancy that CWE-1334 exploits.
Network segmentation can hinder remote injection paths into hardware redundancy controllers.
Secure system architecture principles include designing redundancy so that single-point error injection is harder.