Back to overview

CVE-2018-25320

CRITICAL Exploitation: PoC
9.8
CVSS 3.1
Description
ACL Analytics versions 11.x through 13.0.0.579 contain an arbitrary code execution vulnerability that allows attackers to execute arbitrary commands by leveraging the EXECUTE function. Attackers can use bitsadmin to download malicious PowerShell scripts and execute them with system privileges to establish reverse shells and gain complete system control.

Metadata

CVE ID
CVE-2018-25320
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-05-17 11:34 UTC
Published
2026-05-17 12:11 UTC
Last updated
2026-05-26 11:51 UTC
Primary CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')
Vendor / Product
acl / ACL Analytics
Sources
cve.org  ·  NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
acl ACL Analytics — 11.0 ≤ 13.0.0.579
Weakness (CWE)
CWESourceDescription
CWE-94 cna Improper Control of Generation of Code ('Code Injection')
CVSS scores (2)
ScoreSeverityVersionSourceVector
9.8 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 CRITICAL 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References (4)
Back to overview