Security readout for executives and security teams
Plain-English summary
Notebook Pro 2.0 can be crashed by abuse of the notebook name field. The impact is local denial of service: lost application availability and possible interruption to users, not documented data theft or privilege escalation.
Executive priority
Handle as a moderate endpoint resilience issue. Prioritize remediation where Notebook Pro 2.0 supports business workflows or shared machines, but it should not outrank remotely exploitable or data-impacting vulnerabilities.
Technical view
CVE-2018-25378 affects Stokedonit Notebook Pro 2.0. Sources describe improper handling of excessively large notebook-name input, mapped to CWE-789, causing an application crash. CVSS 4.0 is 6.9 with local attack vector and high vulnerable-system availability impact.
Likely exposure
Exposure is limited to environments where Notebook Pro 2.0 is installed and local users can create notebooks. There is no evidence in the provided sources of network exposure, server-side impact, or other affected versions.
Exploitation context
A public ExploitDB reference exists, but the CVE is not listed as KEV and the provided sources do not state active exploitation. Treat this as publicly documented local denial of service, not confirmed in-the-wild exploitation.
Researcher notes
The record names only Notebook Pro 2.0 and only availability impact. The source bundle does not identify a vendor patch, workaround, or active exploitation. Avoid expanding scope beyond the named product/version without additional evidence.
Mitigation direction
- Inventory endpoints for Stokedonit Notebook Pro 2.0 installations.
- Check vendor or trusted advisory sources for updates or replacement guidance.
- Remove or restrict Notebook Pro 2.0 where business need is low.
- Limit use to trusted local users on managed endpoints.
- Monitor for repeated Notebook Pro crashes during notebook creation.
Validation and detection
- Confirm installed product name and version on managed endpoints.
- Review crash reports for Notebook Pro failures tied to notebook creation.
- Check whether untrusted users can access the application locally.
- Validate any update, removal, or replacement in a lab first.
- Document compensating controls if no vendor patch is available.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-789: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2018-25378 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H2.53.6VulnCheckVulnerability scoring details
Base CVSS 4.0 score
6.9MediumVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
6.2MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-45420CVE reference, VulnCheck · exploit
- VulnCheck Advisory: Notebook Pro 2.0 Denial of Service via Notebook Name FieldCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.