LiveActive security incident?Get immediate response
CVE Record

CVE-2018-17496: eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error whi...

eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error while in kiosk mode. By visiting the kiosk and typing ctrl+shift+esc, an attacker could exploit this vulnerability to open the task manager to kill the process or launch new processes on the system.

HighCVSS 8.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2018-17496 affects VisitorPass eVisitorPass 1.5.5.2 kiosks. A person with local access to the kiosk could escape the intended kiosk restriction and gain elevated control over the system. This is mainly a risk for visitor-management terminals in public or semi-public areas.

Executive priority

Treat this as high priority where eVisitorPass kiosks are physically reachable by visitors or contractors. The business risk is loss of kiosk containment, leading to system misuse, service disruption, or broader workstation compromise.

Technical view

The sources describe a local privilege escalation in eVisitorPass kiosk mode. The flaw allows access to system process controls from the kiosk session, enabling process termination or launching new processes. CVSS v3.0 is 8.4 high, with local attack vector, low complexity, no privileges required, and high confidentiality, integrity, and availability impact.

Likely exposure

Exposure is limited to systems running VisitorPass eVisitorPass 1.5.5.2, especially kiosks reachable by visitors, contractors, reception traffic, or other untrusted local users.

Exploitation context

The CVE is not listed as KEV in the provided bundle, and no cited source states active exploitation. The issue still matters because exploitation requires only local kiosk access, which may be realistic for visitor terminals.

Researcher notes

Evidence is narrow but clear: affected product and version are identified, and the weakness is local kiosk-mode escape leading to elevated system control. Sources do not provide a fixed version, detailed advisory text, CWE mapping, or active exploitation evidence.

Mitigation direction

  • Identify all eVisitorPass kiosk installations and versions.
  • Check VisitorPass or IBM X-Force guidance for supported remediation.
  • Prioritize remediation for public or lobby-facing kiosks.
  • Restrict physical access to kiosk keyboards and system controls.
  • Use vendor-supported kiosk hardening where available.
  • Monitor for unexpected process launches on kiosk endpoints.

Validation and detection

  • Inventory systems for VisitorPass eVisitorPass 1.5.5.2.
  • Confirm whether affected systems operate in kiosk mode.
  • Review endpoint logs for unexpected process starts or terminations.
  • Check whether local kiosk access is available to untrusted users.
  • Verify remediation status against vendor or X-Force guidance.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2018-17496 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.4 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/C:H/AC:L/I:H/A:H/PR:N/AV:L/S:U/UI:N/RC:C/RL:O/E:U

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.4CVSS 3.0HighCVSS:3.0/C:H/AC:L/I:H/A:H/PR:N/AV:L/S:U/UI:N/RC:C/RL:O/E:U2.55.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

8.4High
CVSS 3.0 vector shape for CVE-2018-17496Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/C:H/AC:L/I:H/A:H/PR:N/AV:L/S:U/UI:N/RC:C/RL:O/E:U

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
VisitorPasseVisitorPass1.5.5.2Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.