LiveActive security incident?Get immediate response
CVE Record

CVE-2018-0015: AppFormix: Debug Shell Command Execution in AppFormix Agent

A malicious user with unrestricted access to the AppFormix application management platform may be able to access a Python debug console and execute system commands with root privilege. The AppFormix Agent exposes the debug console on a host where AppFormix Agent is executing. If the host is executing AppFormix Agent, an attacker may access the debug console and execute Python commands with root privilege. Affected AppFormix releases are: All versions up to and including 2.7.3; 2.11 versions prior to 2.11.3; 2.15 versions prior to 2.15.2. Juniper SIRT is not aware of any malicious exploitation of this vulnerability, however, the issue has been seen in a production network. No other Juniper Networks products or platforms are affected by this issue.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

CVE-2018-0015 lets an unauthenticated attacker reach a Python debug console exposed by Juniper AppFormix Agent and run system commands as root. For any organization still running affected AppFormix releases, this is a full host compromise risk, not just an application bug.

Executive priority

Prioritize immediately if AppFormix is present. This vulnerability can give an attacker root-level control of affected hosts over the network. If AppFormix is not deployed, document non-exposure and close as not applicable.

Technical view

Affected AppFormix Agent releases expose a debug console on hosts running the agent. The CVSS 3.0 vector is network-accessible, low complexity, no privileges, no user interaction, with high confidentiality, integrity, and availability impact. Affected releases are up to 2.7.3, 2.11 before 2.11.3, and 2.15 before 2.15.2.

Likely exposure

Exposure is limited to environments running Juniper AppFormix Agent in the affected version ranges. The risky surface is any host where the agent executes and the exposed debug console is reachable by an attacker.

Exploitation context

Juniper stated it was not aware of malicious exploitation, but the issue had been seen in a production network. The source bundle says this CVE is not in KEV. Treat reachable affected agents as urgent because exploitation requires no credentials.

Researcher notes

Do not generalize this to other Juniper products; the source says no other Juniper Networks products or platforms are affected. Evidence supports severe impact and production observation, but not confirmed malicious exploitation. Validate exposure through asset inventory, version checks, and network reachability, not assumptions.

Mitigation direction

  • Inventory all AppFormix Agent deployments and versions.
  • Move affected 2.11 deployments to 2.11.3 or later.
  • Move affected 2.15 deployments to 2.15.2 or later.
  • For 2.7.x deployments, check Juniper guidance for supported upgrade paths.
  • Restrict network access to AppFormix Agent hosts until fixed.

Validation and detection

  • Confirm whether AppFormix Agent is installed on each managed host.
  • Record exact AppFormix version and compare with affected ranges.
  • Verify the debug console is not reachable from untrusted networks.
  • Review logs for unexpected debug console access or root command activity.
  • Confirm remediation by retesting version and network exposure.
Prepared
Confidence
high
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2018-0015 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.0CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

9.8Critical
CVSS 3.0 vector shape for CVE-2018-0015Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Juniper NetworksAppFormix2.7, 2.11, 2.15Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.