CVE-2018-5547
published 2018-08-17CVE-2018-5547: Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7.1.7.1 for Windows by default uses Legacy logon mode which uses a SYSTEM account to…
PriorityP337high7.8CVSS 3.0
AVLACLPRLUINSUCHIHAH
EPSS
0.26%
17.7th percentile
Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7.1.7.1 for Windows by default uses Legacy logon mode which uses a SYSTEM account to establish network access. This feature displays a certificate user interface dialog box which contains the link to the certificate policy. By clicking on the link, unprivileged users can open additional dialog boxes and get access to the local machine windows explorer which can be used to get administrator privilege. Windows Logon Integration is vulnerable when the APM client is installed by an administrator on a user machine. Users accessing the local machine can get administrator privileges
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| f5 | big-ip_access_policy_manager_client | — | — |
| f5 | big-ip_access_policy_manager_client | — | — |
| f5 | big-ip_access_policy_manager_client | — | — |
| f5 | big-ip_access_policy_manager_client | — | — |
| f5 | big-ip_apm | — | — |
| f5_networks_inc | big-ip_apm_client_for_windows | — | — |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-m3rp-fqh4-whc7: Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7
ghsa_unreviewed·2022-05-13
CVE-2018-5547 [HIGH] CWE-862 GHSA-m3rp-fqh4-whc7: Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7
Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7.1.7.1 for Windows by default uses Legacy logon mode which uses a SYSTEM account to establish network access. This feature displays a certificate user interface dialog box which contains the link to the certificate policy. By clicking on the link, unprivileged users can open additional dialog boxes and get access to the local machine windows explorer which can be used to get administrator privilege. Windows Logon Integration is vulnerable when the APM client is installed by an administrator on a user machine. Users accessing the local machine can get administrator privileges
F5
CVE-2018-5547: Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7
vendor_f5·2018-08-17·CVSS 7.8
CVE-2018-5547 [HIGH] CWE-862 CVE-2018-5547: Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7
CVE-2018-5547: Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7
Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7.1.7.1 for Windows by default uses Legacy logon mode which uses a SYSTEM account to establish network access. This feature displays a certificate user interface dialog box which contains the link to the certificate policy. By clicking on the link, unprivileged users can open additional dialog boxes and get access to the local machine windows explorer which can be used to get administrator privilege. Windows Logon Integration is vulnerable when the APM client is installed by an administrator on a user machine. Users accessing the local machine can get administrator privileges
Affected Products: BIG-IP APM, Big-Ip Access Pol
No detection rules found.
No public exploits indexed.
http://www.securitytracker.com/id/1041511https://support.f5.com/csp/article/K10015187https://support.f5.com/csp/article/K10015187?utm_source=f5support&%3Butm_medium=RSShttp://www.securitytracker.com/id/1041511https://support.f5.com/csp/article/K10015187https://support.f5.com/csp/article/K10015187?utm_source=f5support&%3Butm_medium=RSS
2018-08-17
Published