Which products and versions are affected by CVE-2018-1217?

Affected: Emc Avamar (Dell) versions 7.3.1, 7.4.1, 7.5.0; Emc Integrated Data Protection Appliance (Dell) versions 2.0, 2.1; Avamar, Integrated Data Protection Appliance versions >= Avamar Server versions 7.3.1, 7.4.1, 7.5.0. The full list is in the CVE brief.

Is CVE-2018-1217 being exploited in the wild?

It is exploited in the wild, listed in Industry KEV feed, CIRCL KEV since Feb 11, 2025.

Is CVE-2018-1217 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2018-1217?

Public exploit code is available.

Is there a fix for CVE-2018-1217?

No fixed version is listed yet; check the vendor advisory for mitigations.

How urgently should CVE-2018-1217 be patched?

Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Request A Demo

Vulnerability Intelligence

CVE-2018-1217

CriticalExploitedPublic exploit

Published Apr 9, 2018 · Updated Nov 21, 2024

Key Facts

Patch immediately

CVE-2018-1217 is a critical-severity vulnerability (CVSS 9.8 v3) affecting Emc Avamar (Dell), Emc Integrated Data Protection Appliance (Dell), Avamar, Integrated Data Protection Appliance.
It is exploited in the wild, listed in Industry KEV feed, CIRCL KEV since Feb 11, 2025. Public exploit code is available.
EPSS estimates a 51% probability of exploitation in the next 30 days.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3

9.8

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

51%

Higher than 98.9% of all scored CVEs

Exploited in the wild

Yes

2 catalog listings

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2018-1217 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1, is affected by a missing access control check vulnerability which could potentially allow a remote unauthenticated attacker to read or change the Local Download Service (LDLS) credentials. The LDLS credentials are used to connect to Dell EMC Online Support. If the LDLS configuration was changed to an invalid configuration, then Avamar Installation Manager may not be able to connect to Dell EMC Online Support web site successfully. The remote unauthenticated attacker can also read and use the credentials to login to Dell EMC Online Support, impersonating the AVI service actions using those credentials.

Known-Exploited Catalog Listings

Catalog	Added	Remediation due	Ransomware use
Industry KEV feed	Feb 11, 2025	n/a	Not reported
CIRCL KEV	Feb 11, 2025	n/a	Not reported

Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Affected Products

6 affected entries in total

Product	Affected versions	Fixed in
Emc AvamarDell	7.3.1, 7.4.1, 7.5.0	n/a
Emc Integrated Data Protection ApplianceDell	2.0, 2.1	n/a
Avamar, Integrated Data Protection Appliance	>= Avamar Server versions 7.3.1, 7.4.1, 7.5.0	n/a

Timeline

Publicly disclosed
Apr 9, 2018
Last updated
Nov 21, 2024
Added to Industry KEV feed
Feb 11, 2025
Added to CIRCL KEV
Feb 11, 2025

Weakness Type

CWE-862 Missing Authorization

References

advisory20180405 DSA-2018-025: Dell EMC Avamar and Integrated Data Protection Appliance Installation Manager Missing Access Control Vulnerability
advisory1040641
exploitVulnCheck exploitation report
exploitVulnCheck exploitation report
exploitVulnCheck exploitation report

9 more references in the full CVE brief

FAQ

Common Questions.

Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1, is affected by a missing access control check vulnerability which could potentially allow a remote unauthenticated attacker to read or change the Local Download Service (LDLS) c…
Affected: Emc Avamar (Dell) versions 7.3.1, 7.4.1, 7.5.0; Emc Integrated Data Protection Appliance (Dell) versions 2.0, 2.1; Avamar, Integrated Data Protection Appliance versions >= Avamar Server versions 7.3.1, 7.4.1, 7.5.0. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed, CIRCL KEV since Feb 11, 2025.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Is CVE-2018-1217 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.