CVE-2018-17538
📋 TL;DR
CVE-2018-17538 is a process injection vulnerability in Axon Evidence Sync 3.15.89 that allows attackers to execute arbitrary code with elevated privileges. This affects organizations using Axon's evidence management software for law enforcement and security operations. The vendor disputes the vulnerability's validity, but the CVSS score suggests critical impact.
💻 Affected Systems
- Axon Evidence Sync
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary code with high privileges, potentially leading to data theft, evidence tampering, or lateral movement within law enforcement networks.
Likely Case
Local privilege escalation or unauthorized code execution on affected systems, compromising evidence integrity and system security.
If Mitigated
Limited impact if systems are isolated, have strict access controls, and run with minimal privileges.
🎯 Exploit Status
Limited public information due to vendor dispute. Likely requires local access or initial foothold.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor disputes vulnerability
Restart Required: No
Instructions:
Contact Axon support for guidance. Consider upgrading to latest version if available.
🔧 Temporary Workarounds
Restrict Local Access
allLimit user access to systems running Evidence Sync to authorized personnel only
Network Segmentation
allIsolate Evidence Sync systems from general network access
🧯 If You Can't Patch
- Implement strict access controls and least privilege principles
- Monitor systems for unusual process activity and network connections
🔍 How to Verify
Check if Vulnerable:
Check Evidence Sync version in application interface or installation directoryCheck Version:
Check application GUI or installation propertiesVerify Fix Applied:
Verify version is newer than 3.15.89 or contact vendor for confirmation📡 Detection & Monitoring
Log Indicators:
- Unusual process creation events
- Unexpected service or application behavior
Network Indicators:
- Unexpected outbound connections from Evidence Sync process
SIEM Query:
Process creation where parent process contains 'Evidence Sync' and child process is unexpected🔗 References
- https://github.com/GitHubAssessments/CVE_Assessment_05_2018/blob/master/Evidence_Review_Report.pdf
- https://github.com/GitHubAssessments/CVE_Assessment_05_2018/blob/master/Evidence_Sync_Report.pdf
- https://raw.githubusercontent.com/GitHubAssessments/CVE_Assessment_05_2018/master/Evidence_Sync_Report.pdf
- https://github.com/GitHubAssessments/CVE_Assessment_05_2018/blob/master/Evidence_Review_Report.pdf
- https://github.com/GitHubAssessments/CVE_Assessment_05_2018/blob/master/Evidence_Sync_Report.pdf
- https://raw.githubusercontent.com/GitHubAssessments/CVE_Assessment_05_2018/master/Evidence_Sync_Report.pdf
