Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-14055: ZNC allows non-admin user to gain admin rights

CVE-2018-14055 · published 8 years ago

Summary

The ZNC chat relay software (including Debian packages) does not correctly check data it receives from the network. Because of this, a regular user can trick the system into giving them administrator privileges and change configuration settings. Update ZNC to the latest version or apply the provided patch to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
znc	znc	<= 1.7.0 `cpe:2.3:a:znc:znc::::::::`
debian	debian_linux	9.0 `cpe:2.3:o:debian:debian_linux:9.0:::::::*`

Original advisory text

ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to escalate his privilege and inject rogue values into znc.conf.

References

https://github.com/znc/znc/commit/a7bfbd93812950b7444841431e8e297e62cb524e Patch Third Party Advisory
https://github.com/znc/znc/commit/d22fef8620cdd87490754f607e7153979731c69d Patch Third Party Advisory
https://security.gentoo.org/glsa/201807-03 Third Party Advisory
https://www.debian.org/security/2018/dsa-4252 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-20Improper Input Validation

Timeline

Published15 Jul 2018

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2018-14055 · NVD

Track software like this

Free during beta