CVE-2018-25225 is a stack-based buffer overflow vulnerability in SIPP 3.3, allowing local unauthenticated attackers to execute arbitrary code. This occurs when a specially crafted configuration file with oversized values overflows a stack buffer, enabling return-oriented programming. With a CVSS score of 8.4 HIGH, it poses a significant risk to confidentiality, integrity, and availability, requiring local access but no authentication. Currently, there is no evidence of active exploitation, and no public exploit code is available in common repositories like Metasploit or ExploitDB. Despite a recent community mention, its EPSS score is very low, and it is not listed in the CISA KEV catalog, indicating a low likelihood of widespread exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
3.3CPE matchmatch criteria | cpe:2.3:a:sipp_project:sipp:3.3:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.5 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.