CVE-2018-11154

Vulnerability

Quest DR Series Disk Backup software prior to version 4.0.3.1 contains a command injection vulnerability (identified as issue 12 of 46). The exact component and input vector are not detailed in the available references, but the flaw allows an attacker to inject arbitrary operating system commands via crafted requests [1].

Exploitation

The attacker must have authenticated access to the Quest DR Series management interface. By sending specially crafted HTTP requests to an affected endpoint, the attacker can inject arbitrary commands. No user interaction beyond authentication is required [1].

Impact

Successful exploitation enables arbitrary command execution with the privileges of the web application server (typically root or a privileged user). This can lead to full system compromise, including unauthorized data access, modification, or denial of service [1].

Mitigation

Quest released version 4.0.3.1 to fix this vulnerability. Users should upgrade immediately to this version or later. No workarounds are documented in the available references. The CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of publication [1].