Vulnerabilities > CVE-2018-7493 - Unspecified vulnerability in Cactusvpn

CVSS 10.0 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

network

low complexity

cactusvpn

critical

NVD

Published: 2018-03-05

Updated: 2021-09-22

Summary

CactusVPN through 6.0 for macOS suffers from a root privilege escalation vulnerability in its privileged helper tool. The privileged helper tool implements an XPC interface, which allows arbitrary applications to execute system commands as root.

Vulnerable Configurations

Part	Description	Count
Application	Cactusvpn Cactusvpn Cactusvpn 2.0.1 Cactusvpn Cactusvpn 3.0.1 Cactusvpn Cactusvpn 3.0.3 Cactusvpn Cactusvpn 5.0.0 Cactusvpn Cactusvpn 5.0.1 Cactusvpn Cactusvpn 5.1.0 Cactusvpn Cactusvpn 5.2.0 Cactusvpn Cactusvpn 5.2.1 Cactusvpn Cactusvpn 5.2.2 Cactusvpn Cactusvpn 5.2.3 Cactusvpn Cactusvpn 5.3.0 Cactusvpn Cactusvpn 5.3.1 Cactusvpn Cactusvpn 5.3.2 Cactusvpn Cactusvpn 5.3.3 Cactusvpn Cactusvpn 5.3.4 Cactusvpn Cactusvpn 5.3.5 Cactusvpn Cactusvpn 5.3.6 Cactusvpn Cactusvpn 6.0	35
OS	Apple Apple Macos *	1

References

https://github.com/VerSprite/research/blob/master/advisories/VS-2018-007.md