CVE-2018-1242

CVE-2018-1242 describes a command injection vulnerability in the Boxmgmt CLI of Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3. An authenticated attacker with boxmgmt privileges could exploit this to read certain RPA files, though files requiring root permissions are unaffected. Rated Medium severity with a CVSS score of 6.5, this vulnerability has a network attack vector and low attack complexity, potentially leading to high confidentiality impact. There is no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or KEV listing, though it has received limited community discussion and media coverage.