CVE-2018-18325: DNN (DotNetNuke) weak encryption of input parameters

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw is remotely exploitable without authentication or user interaction, has a high CVSS score, is in CISA KEV, and has very high EPSS probability with public exploit references.

What it is

DNN (DotNetNuke) versions 9.2 through 9.2.2 use a weak encryption algorithm to protect input parameters, and the issue persists because the fix for CVE-2018-15811 was incomplete. Weak protection of parameters can let an attacker read or tamper with data the application assumes is confidential or trustworthy.

Impact

An attacker can recover or manipulate protected input parameters, leading to disclosure of sensitive data and potentially enabling further attacks such as cookie deserialization remote code execution as referenced in public exploit material.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N; the flaw is in how the application encrypts input parameters.

Exploitation

It is listed in CISA KEV with a 2021-11-03 addition date, and EPSS shows a 30-day probability of 0.74048 (99.458th percentile); references include an Exploit-tagged Packet Storm entry for DotNetNuke cookie deserialization RCE.

What to do

• Upgrade DNN to a release newer than 9.2.2 that contains the complete fix for CVE-2018-15811 and this follow-up issue, per vendor instructions.
• If immediate upgrade is not possible, restrict network access to the DNN instance and place it behind authentication or a reverse proxy where feasible.
• Rotate any secrets, cookies, or tokens that may have been protected by the weak algorithm.
• Monitor vendor security advisories and release notes for DNN platform updates addressing this issue.

Detection

• Inspect DNN request and response traffic for tampered or replayed encrypted parameters, especially cookie values tied to deserialization.
• Alert on anomalous POST requests or cookie payloads to DNN endpoints that match known deserialization exploit patterns.
• Review web server and application logs for unexpected deserialization errors, exceptions, or process behavior on DNN hosts.
• Hunt for outbound connections or child processes spawned by the DNN application worker that are inconsistent with normal operation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.