CVE-2018-0438

CVE-2018-0438 describes a local privilege escalation vulnerability in the Cisco Umbrella Enterprise Roaming Client (ERC) on Windows. This flaw stems from improper file system permissions, allowing an authenticated local user to place malicious executables in restricted directories, which the ERC client then executes with Administrator privileges. The vulnerability has a CVSSv3 score of 7.8 (High), indicating a significant risk. Exploitation requires local user authentication and low attack complexity, as the attacker simply needs to place a file. A successful exploit grants full Administrator privileges, leading to high impact on confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, exploit code for this vulnerability is publicly available on ExploitDB. There has been limited community discussion and media coverage, with one article from BleepingComputer mentioning it among other Cisco security alerts.