CVE-2018-25259: lizardsystems terminal services manager

csirt@kutim:~/threat-intel/cve/CVE-2018-25259

CVSS 7.8 · High EPSS 0,19%

Kerentanan Missing Authentication for Critical Function pada lizardsystems terminal services manager. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Terminal Services Manager 3.1 contains a stack-based buffer overflow vulnerability in the computer names field that allows local attackers to execute arbitrary code by triggering structured exception handling. Attackers can craft a malicious input file with shellcode and jump instructions that overwrite the SEH handler pointer to execute calc.exe or other payloads when imported through the add computers wizard.

Rincian

Terbit di NVD: 22 April 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-306: Missing Authentication for Critical Function
EPSS (30 hari): 0,19% peluang dieksploitasi; lebih tinggi dari 7,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
lizardsystems	terminal services manager	Semua versi hingga 3.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.vulncheck.com/advisories/terminal-services-manager-buffer-overflow-seh advisory pihak ketiga
https://www.exploit-db.com/exploits/46058 exploit · vdb entry
https://lizardsystems.com product

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.