CVE-2018-5299 is a critical stack-based buffer overflow vulnerability affecting the web server component of Pulse Secure Pulse Connect Secure (PCS) before 8.3R4 and Pulse Policy Secure (PPS) before 5.4R4. This flaw allows for memory corruption and could lead to remote code execution. With a CVSS score of 9.8 (CRITICAL), it is easily exploitable over the network without authentication or user interaction, enabling full compromise of confidentiality, integrity, and availability. While no public exploit code is readily available (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, with over 4,000 vulnerable Pulse Connect Secure hosts reportedly exposed to the internet.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 8.3r1, <= 8.3r3CPE matchmatch criteria | cpe:2.3:a:pulsesecure:pulse_connect_secure:*:*:*:*:*:*:*:* | ||
>= 5.4r1, <= 5.4r3CPE matchmatch criteria | cpe:2.3:a:pulsesecure:pulse_policy_secure:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.