Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2015-5699: Cumulus Linux lets local users execute unintended commands

CVE-2015-5699 · published 9 years ago

Summary

On Cumulus Linux versions up to 2.5.3, the Switch Configuration Tools Backend (clcmd_server) accepts specially crafted labels in the cl-rctl command. A local user can include shell symbols in the label to run any command they choose, potentially altering system settings or accessing data. Apply the latest software update from Cumulus Networks or restrict local access to the tool until the update is installed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
cumulusnetworks	cumulus_linux	<= 2.5.3 `cpe:2.3:o:cumulusnetworks:cumulus_linux::::::::`

Original advisory text

The Switch Configuration Tools Backend (clcmd_server) in Cumulus Linux 2.5.3 and earlier allows local users to execute arbitrary commands via shell metacharacters in a cl-rctl command label.

References

http://seclists.org/fulldisclosure/2015/Aug/23 Mailing List Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-264Permissions, Privileges, and Access Controls

Timeline

Published22 Oct 2017

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2015-5699 · NVD

Track software like this

Free during beta