CVE-2018-16118

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A shell escape vulnerability in /webconsole/APIController in the API Configuration component of Sophos XG firewall 17.0.8 MR-8 allows remote attackers to execute arbitrary OS commands via shell metachracters in the "X-Forwarded-for" HTTP header.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://community.sophos.com/kb/en-us/132637Vendor Advisory
https://github.com/klsecservices/Advisories/blob/master/KL-SOPHOS-2018-003.mdPatch, Third Party Advisory
https://www.sophos.com/en-us/legal/sophos-responsible-disclosure-policy.aspxVendor Advisory
https://community.sophos.com/kb/en-us/132637Vendor Advisory
https://github.com/klsecservices/Advisories/blob/master/KL-SOPHOS-2018-003.mdPatch, Third Party Advisory
https://www.sophos.com/en-us/legal/sophos-responsible-disclosure-policy.aspxVendor Advisory

Timeline

Published: Jun 20, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-161197.2Stack-based buffer overflow in the httpd server of TP-Link WR1043nd (Firmware Version 3) allows remote attackers to execute arbitrary code v CVE-2018-16125.8IBM QRadar Incident Forensics (IBM QRadar SIEM 7.2, and 7.3) could allow a remote attacker to bypass authentication and obtain sensitive inf CVE-2018-161308.8System command injection in request_mitv in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary system commands via the CVE-2018-161317.5The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote atta CVE-2018-161328.6The image rendering component (createGenericPreview) of the Open Whisper Signal app through 2.29.0 for iOS fails to check for unreasonably l CVE-2018-161335.3Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.CVE-2018-161346.1Cybrotech CyBroHttpServer 1.0.3 allows XSS via a URI.CVE-2018-161356.5The Opera Mini application 47.1.2249.129326 for Android allows remote attackers to spoof the Location Permission dialog via a crafted web si CVE-2018-161368.8An issue was discovered in the administrator interface in IPBRICK OS 6.3. The application doesn't check for Anti-CSRF tokens, allowing the s CVE-2018-161378.8An issue was discovered in the Web Management Console in IPBRICK OS 6.3. There are multiple SQL injections.CVE-2018-161384.8An issue was discovered in the administration page in IPBRICK OS 6.3. There are multiple XSS vulnerabilities.CVE-2018-161396.1Cross-site scripting (XSS) vulnerability in BIBLIOsoft BIBLIOpac 2008 allows remote attackers to inject arbitrary web script or HTML via the