← Vulnerability feed

Vulnerability record · CVE-2018-11077 · published 26 November 2018

CVE-2018-11077: Dell emc avamar os command injection vulnerability

Dell · Emc Avamar

'getlogs' utility in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1 and 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 and 2.2 is affected by an OS command injection vulnerability. A malicious Avamar admin user may potentially be able to execute arbitrary commands under root privilege.

6.7 CVSS 3.0 Medium EPSS 1.0% · top 38.5% CWE-78 · OS command injection
6.7CVSS 3.0 base score, v2 7.2
1.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

'getlogs' utility in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1 and 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 and 2.2 is affected by an OS command injection vulnerability. A malicious Avamar admin user may potentially be able to execute arbitrary commands under root privilege.

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/105971 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1042153 Third Party AdvisoryVDB Entry
https://seclists.org/fulldisclosure/2018/Nov/51 Mailing ListThird Party Advisory
https://www.vmware.com/security/advisories/VMSA-2018-0029.html PatchThird Party Advisory
http://www.securityfocus.com/bid/105971 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1042153 Third Party AdvisoryVDB Entry
https://seclists.org/fulldisclosure/2018/Nov/51 Mailing ListThird Party Advisory
https://www.vmware.com/security/advisories/VMSA-2018-0029.html PatchThird Party Advisory

Track CVE-2018-11077 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2020-29495Dell emc avamar server path traversal vulnerabilityDELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain an OS Command Injection Vulnerability in Fitness Analyzer. A remote unauthenticated attack…EPSS 6.2%9.8CVE-2020-29493Dell emc avamar server sql injection vulnerabilityDELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain a SQL Injection Vulnerability in Fitness Analyzer. A remote unauthenticated attacker could…EPSS 2.6%9.8CVE-2018-11066Dell emc avamar vulnerabilityDell EMC Avamar Client Manager in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1, 18.1 and Dell EMC Integrate…EPSS 9.9%9.8CVE-2018-1217Dell EMC Avamar Installation Manager missing access control exposes LDLS credentialsDell EMC Avamar Server and Integrated Data Protection Appliance contain a missing access control check in Avamar Installation Manager. A remote unaut…EPSS 51%analysed9.8CVE-2017-4914Vmware vsphere data protection deserialization of untrusted data vulnerabilityVMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote a…EPSS 8.8%9.8CVE-2017-4917Vmware vsphere data protection broken cryptographic algorithm vulnerabilityVMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x locally stores vCenter Server credentials using reversible encryption. This issue…EPSS 0.84%9.8CVE-2016-7456Vmware vsphere data protection vulnerabilityVMware vSphere Data Protection (VDP) 5.5.x though 6.1.x has an SSH private key with a publicly known password, which makes it easier for remote attac…EPSS 33%8.8CVE-2018-11062Dell emc integrated data protection appliance hard-coded credentials vulnerabilityIntegrated Data Protection Appliance versions 2.0, 2.1, and 2.2 contain undocumented accounts named 'support' and 'admin' that are protected with def…EPSS 1.8%

Source: NIST National Vulnerability Database (record CVE-2018-11077), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.