Back to overview

CVE-2018-25272

CRITICAL
9.8
CVSS 3.1
Description
ELBA5 5.8.0 contains a remote code execution vulnerability that allows attackers to obtain database credentials and execute arbitrary commands with SYSTEM level permissions. Attackers can connect to the database using default connector credentials, decrypt the DBA password, and execute commands via the xp_cmdshell stored procedure or add backdoor users to the BEDIENER table.

Metadata

CVE ID
CVE-2018-25272
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-04-22 14:33 UTC
Published
2026-04-22 14:57 UTC
Last updated
2026-04-22 18:37 UTC
Primary CWE
CWE-326
Inadequate Encryption Strength
Vendor / Product
Elba / ELBA5
Sources
cve.org  ·  NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
Elba ELBA5 — 5.8.0
Weakness (CWE)
CWESourceDescription
CWE-326 cna Inadequate Encryption Strength
CVSS scores (2)
ScoreSeverityVersionSourceVector
9.8 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 CRITICAL 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References (3)
Back to overview