CVE-2018-15811: DNN (DotNetNuke) weak encryption of input parameters

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityThe flaw is in CISA KEV with a past remediation due date and an EPSS score above the 99th percentile, so it should be treated as actively exploited.

What it is

DNN (DotNetNuke) versions 9.2 through 9.2.1 use a weak encryption algorithm to protect input parameters. Because the protection is inadequate, data that the product intends to keep confidential can be recovered or manipulated by an attacker who can observe or supply those parameters. The record does not name the specific algorithm or the exact parameters involved.

Impact

An attacker can read or tamper with parameter data that DNN intended to protect with encryption, leading to confidentiality loss. The CVSS vector rates confidentiality impact as high with no integrity or availability impact.

Attack surface

The flaw is reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any exposed DNN 9.2 to 9.2.1 endpoint that accepts these encrypted input parameters is in scope.

Exploitation

CVE-2018-15811 is listed in CISA KEV with a due date of 2022-05-03, and EPSS gives a 30-day probability of 0.74048 (99.458th percentile), indicating active exploitation is expected. A Packet Storm reference tagged Exploit points to a DotNetNuke cookie deserialization remote code execution write-up, though the record does not state that this CVE is the exact flaw in that exploit.

What to do

• Upgrade DNN to a release after 9.2.1 per the vendor security center and release notes; this is the primary fix.
• If immediate upgrade is not possible, restrict network access to DNN instances so only trusted clients can reach parameter-handling endpoints.
• Review and rotate any secrets or keys used by the weak parameter encryption, since exposure may already have occurred.
• Monitor vendor advisories for DNN 9.2.x for any backported fix or additional guidance.

Detection

• Inspect DNN request logs for repeated or anomalous submissions of encrypted parameters from single sources.
• Alert on attempts to decode or replay DNN parameter values, including malformed or truncated ciphertext.
• Correlate DNN access logs with known exploitation indicators from the Packet Storm cookie deserialization write-up.
• Track outbound or lateral activity from DNN hosts that could follow parameter disclosure.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.