{"schemaVersion":3,"id":"CVE-2018-1242","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contains a command injection vulnerability in the Boxmgmt CLI. An authenticated malicious user with boxmgmt privileges may potentially exploit this vulnerability to read RPA files. Note that files that require root permission cannot be read.","dates":{"published":"2018-05-29T17:00:00.000Z","modified":"2024-09-16T20:32:13.130Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.5,"severity":"medium","version":"3.0","versionLabel":"v3.0","source":"NVD","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":6.5,"severity":"medium","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4,"severity":"medium","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.02638,"percentile":0.85325,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":-0.09799999999999982,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.02736},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02487,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02638,"percentile":0.85325}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02487,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02736,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02638,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02638,"percentile":0.85325}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","description":"The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/78.html"}],"affected":[{"vendor":"dell emc","product":"dell emc recoverpoint","name":"Dell EMC RecoverPoint","label":"dell emc recoverpoint","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < 5.1.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < 5.1.2","eol":null,"hubHref":"/vendor/dell_emc/dell_emc_recoverpoint"},{"vendor":"dell emc","product":"dell emc recoverpoint virtual machine (vm)","name":"Dell EMC RecoverPoint Virtual Machine (VM)","label":"dell emc recoverpoint virtual machine (vm)","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < 5.1.1.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < 5.1.1.3","eol":null,"hubHref":"/vendor/dell_emc/dell_emc_recoverpoint_virtual_machine_vm"},{"vendor":"emc","product":"recoverpoint","name":"recoverpoint","label":"recoverpoint","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.2","eol":null,"hubHref":"/vendor/emc/recoverpoint"},{"vendor":"emc","product":"recoverpoint_for_virtual_machines","name":"recoverpoint for virtual machines","label":"recoverpoint_for_virtual_machines","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.1.1.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.1.1.3","eol":null,"hubHref":"/vendor/emc/recoverpoint_for_virtual_machines"}],"affectedCount":4,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://seclists.org/fulldisclosure/2018/May/61","label":"seclists.org/fulldisclosure/2018/May/61","hostname":"seclists.org","tags":["Mailing List","X Refsource FULLDISC","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/104246","label":"www.securityfocus.com/bid/104246","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2018-05-29T17:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-09-16T20:32:13.130Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":27,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T12:48:42.819Z","stale":false,"partial":false}}