CVE-2018-1217

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.09.8Critical EPSS percentile99th51% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixNone yetNo fix or workaround published

Published 2018-04-09Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Ask IT to confirm whether you run Dell EMC Avamar Installation Manager with Avamar Server 7.3.1, 7.4.1, or 7.5.0, or Integrated Data Protection Appliance 2.0 or 2.1.
No fixed version is identified in the available patch information; ask Dell EMC for the supported corrected release for your installation.
Restrict access to the Installation Manager service to trusted administrator networks until Dell provides remediation.
Change the Local Download Service credentials after access is restricted, and review their use with Dell EMC.

May need vendor or contractor work

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1, is affected by a missing access control check vulnerability which could potentially allow a remote unauthenticated attacker to read or change the Local Download Service (LDLS) credentials. The LDLS credentials are used to connect to Dell EMC Online Support. If the LDLS configuration was changed to an invalid configuration, then Avamar Installation Manager may not be able to connect to Dell EMC Online Support web site successfully. The remote unauthenticated attacker can also read and use the credentials to login to Dell EMC Online Support, impersonating the AVI service actions using those credentials.

In plain language

Written by AI from the record

Dell EMC Avamar Installation Manager in Avamar Server 7.3.1, 7.4.1, and 7.5.0, or Integrated Data Protection Appliance 2.0 and 2.1, has a critical flaw that can expose a Dell support-service login, so affected businesses should act now.

Missing access control in Dell EMC Avamar Installation Manager allows an unauthenticated remote attacker to read or modify Local Download Service credentials, enabling Dell EMC Online Support impersonation and disruption of support connectivity.

If you're affected

Dell support account misuse
Backup update disruption
Service credential exposure
Unauthorized configuration changes

What is it

This flaw can let an outsider access or alter the login details the backup system uses to contact Dell EMC support. It is like leaving the service key for a building’s maintenance desk where anyone can copy it or replace it with a broken one.

Who is affected

This matters to you if your business runs Dell EMC Avamar Installation Manager as part of Avamar or an Integrated Data Protection Appliance. The exposed credentials are used for the system’s connection to Dell EMC Online Support.

How urgent is it

Attackers have a public exploit available for this flaw, so treat affected systems as an immediate priority. There is no known CISA-confirmed active exploitation, but the available exploit and the ability to access support credentials make this a red-level issue.

What to do — in detail

Confirm the installed Avamar Server or Integrated Data Protection Appliance release and verify that Dell EMC Avamar Installation Manager is present and reachable from networks beyond the administrator network. The affected releases identified here are Avamar Server 7.3.1, 7.4.1, and 7.5.0, plus Integrated Data Protection Appliance 2.0 and 2.1.

The available findings do not identify fixed releases or a vendor patch. Obtain the applicable corrected, supported release directly from Dell EMC before upgrading; do not assume that a newer-looking package is sufficient. If patching is delayed, limit Installation Manager access to a dedicated trusted administration network, block unnecessary remote access paths, and rotate the Local Download Service credentials after restricting exposure.

Review Dell EMC Online Support activity associated with these credentials and investigate unexpected configuration changes or failed support-service connections. CISA has not assigned a Known Exploited Vulnerabilities remediation due date for this CVE.

Technical context

CVE-2018-1217 is rated CVSS 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue is missing authorization/access control (CWE-862) in Avamar Installation Manager; a remote unauthenticated attacker can read or alter LDLS credentials. One public exploit is known. It is not listed in CISA KEV, so confirmed exploitation in the wild is not established by the findings. EPSS predicts a 50.9% likelihood (99th percentile) and the trend is falling.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

51% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

unknown.

Real risk signals with little public attention so far.

Lifecycle

14 events over 3089 days, from the signal feeds we watch.

2026-09-23EPSS band changemoderate → highepss band change
2026-09-21EPSS band changehigh → moderateepss band change
2026-09-19EPSS band changemoderate → highepss band change
2026-06-25OpenVAS check added
2026-06-22EPSS band changehigh → moderate
2026-03-06Public exploit / PoCsource: exploit-dbnuclei check added

Affected products

dellcommercial · USaka dell technologies
- emc avamarWeb AppOn-premDatabases / data-warehouse-analytics
- emc integrated data protection applianceOn-premEnterprise Software / itsm-monitoring
Dell EMCcommercial · USaka avamar, isilon onefs, integrated data protection appliance
- Avamar, Integrated Data Protection ApplianceSecurity ProductOn-premSecurity Products / vuln-mgmt-scanner

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

Initial AccessT1078Valid Accountsmedium confidence T1190Exploit Public-Facing Applicationmedium confidence

Sources

References in the record

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Emc Avamar, not every advisory. This one: public exploit.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account