Security readout for executives and security teams
Plain-English summary
CVE-2018-17495 affects VisitorPass eVisitorPass 1.5.5.2 kiosk systems. A person with local access to a kiosk may be able to break out of the intended fullscreen experience and gain elevated access to the underlying system. This is most urgent where kiosks are publicly reachable or weakly supervised.
Executive priority
Prioritize remediation for public-facing visitor kiosks because physical access could become system-level compromise. If affected systems are not deployed or are isolated and supervised, urgency is lower but still requires documented validation.
Technical view
The CVE describes a local privilege escalation caused by an error in the Virtual Keyboard Help Dialog. The reported outcome is access to the system command prompt from the kiosk context. CVSS 3.0 is 8.4, with local attack vector, low complexity, no privileges required, and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure appears limited to organizations running VisitorPass eVisitorPass version 1.5.5.2, especially on visitor-management kiosks in lobbies, reception areas, or other physically accessible locations.
Exploitation context
Sources describe local exploitation requiring access to the kiosk. The bundle does not indicate CISA KEV listing or active exploitation. Public evidence is sparse, so treat exploit status as unknown beyond the reported vulnerability details.
Researcher notes
The source bundle provides the affected version, weakness location, and impact, but limited vendor remediation detail. Avoid assuming broader product versions or active exploitation. Defensive validation should focus on kiosk breakout resistance and installed-version confirmation.
Mitigation direction
- Inventory all eVisitorPass kiosk installations and identify version 1.5.5.2 systems.
- Check VisitorPass or eVisitorPass vendor guidance for updates or supported configuration changes.
- Restrict physical access to affected kiosks until exposure is resolved.
- Review kiosk lockdown controls around help dialogs, fullscreen escape paths, and OS shell access.
- Monitor affected systems for unexpected local administrative activity.
Validation and detection
- Confirm whether eVisitorPass 1.5.5.2 is installed on any kiosk endpoints.
- Verify kiosk users cannot reach operating-system administrative interfaces from application dialogs.
- Review endpoint logs for unusual local process launches or privilege changes.
- Confirm whether vendor updates or configuration guidance have been applied.
- Document compensating physical controls for publicly accessible kiosks.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-17495 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.4 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/UI:N/S:U/I:H/AV:L/A:H/PR:N/AC:L/C:H/E:U/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/UI:N/S:U/I:H/AV:L/A:H/PR:N/AC:L/C:H/E:U/RL:O/RC:C2.55.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
8.4HighVector: CVSS:3.0/UI:N/S:U/I:H/AV:L/A:H/PR:N/AC:L/C:H/E:U/RL:O/RC:C
Source materials
- CVE List V5 sourceCVE List V5
- evisitorpass-help-dialog-cve201817495-pri-esc (149655)CVE reference · vdb-entry, x_refsource_XF
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.