Improper input validation in Microsoft Windows and Windows Server - CVE-2018-0886
Published: March 13, 2018 / Updated: June 17, 2021
Vulnerability identifier: #VU11029
CSH Severity: Medium
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-0886
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to an error when validation authentication requests in Credential Security Support Provider protocol (CredSSP). A remote unauthenticated attacker with ability to perform a Man-in-the-Middle (MitM) attack can execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Microsoft Windows
Windows Server
Opensuse
VisuNet RM
VisuNet PC
Box Thin Client
Windows Server
Opensuse
VisuNet RM
VisuNet PC
Box Thin Client
How to mitigate CVE-2018-0886
Install updates from vendor's website.