#VU17396 Privilege escalation in Carousel - CVE-2018-18929

Vulnerability identifier: #VU17396

Vulnerability risk: Low

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-18929

CWE-ID: CWE-264

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Carousel
Web applications / Remote management & hosting panels

Vendor: Tightrope

Description
The vulnerability allows a remote attacker with administrative privileges can gain full access to the system.

The vulnerability exists due to the Unattend.xml file left on the system included the creation of a local admin account (along with the password). A remote attacker can use an Unattend.xml file to control various settings on the new system when Windows systems are imaged.

Mitigation
Patch will be available on February 8.

Vulnerable software versions

Carousel: 7.0.0 - 7.0.4.104

---

External links
https://www.drewgreen.net/vulnerabilities-in-tightrope-media-systems-carousel/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.