CVE-2018-3969

🗓️ 21 Mar 2019 15:26:08Reported by talosType

cve🔗 web.nvd.nist.gov👁 67 Views🌐 WEB

An exploitable vulnerability in CUJO Smart Firewall's verified boot protection allows for adding arbitrary shell commands into dhcpd.conf, leading to execution of unverified commands

Reporter	Title	Published	Views	Family All 10
cnvd	CUJO Smart Firewall Privilege Permission and Access Control Vulnerability	20 Mar 201900:00	–	cnvd
cvelist	CVE-2018-3969	21 Mar 201915:26	–	cvelist
euvd	EUVD-2018-15755	7 Oct 202500:30	–	euvd
nvd	CVE-2018-3969	21 Mar 201916:29	–	nvd
osv	CVE-2018-3969	21 Mar 201916:29	–	osv
prion	Design/Logic Flaw	21 Mar 201916:29	–	prion
ptsecurity	PT-2019-10733 · Cujo · Cujo Smart Firewall	21 Mar 201900:00	–	ptsecurity
talos	CUJO Smart Firewall dhcpd.conf verified boot bypass	19 Mar 201900:00	–	talos
talosblog	Vulnerability Spotlight: Multiple Vulnerabilities in CUJO Smart Firewall, Das U-Boot, OCTEON SDK, Webroot BrightCloud	19 Mar 201908:00	–	talosblog
threatpost	Host of Flaws Found in CUJO Smart Firewall	19 Mar 201921:43	–	threatpost

NVD

Vulners

Node

getcujo smart_firewallMatch7003

[
  {
    "product": "CUJO",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "CUJO Smart Firewall - Firmware version 7003"
      }
    ]
  }
]

Source	Link
talosintelligence	www.talosintelligence.com/vulnerability_reports/TALOS-2018-0634

Parameter	Position	Path	Description	CWE
dhcpd.conf	path	/config/dhcpd.conf	Arbitrary command execution via modification of /config/dhcpd.conf due to write access in verified boot context.	CWE-78

17 Jun 2026 01:58Current

7.6High risk

Vulners AI Score7.6

CVSS 27.2

CVSS 3.17.8

CVSS 38.2

EPSS0.00501

CWE-78