LiveActive security incident?Get immediate response
CVE Record

CVE-2018-5198: WIZVERA Veraport Race Condition Vulnerability

In Veraport G3 ALL on MacOS, a race condition when calling the Veraport API allow remote attacker to cause arbitrary file download and execution. This results in remote code execution.

HighCVSS 8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2018-5198 affects WIZVERA Veraport G3 on macOS. A race condition in Veraport API handling can let a remote attacker cause file download and execution, resulting in remote code execution. Business risk is high where this client software is installed, especially on endpoints used for sensitive work.

Executive priority

Treat this as a high-priority endpoint exposure if Veraport G3 exists on managed macOS systems. The main decision is whether the software is still required and whether vendor guidance identifies a safe update, replacement, or removal path.

Technical view

The CVE describes a race condition in Veraport G3 ALL on macOS. CVSS 3.0 is 8.0: network attack vector, low complexity, low privileges required, user interaction required, and high confidentiality, integrity, and availability impact. No CWE is listed in the supplied source bundle.

Likely exposure

Exposure is limited to macOS systems running WIZVERA Veraport G3, listed as affected across all G3 versions. Organizations should focus on managed macOS endpoint inventories, software deployment records, and business workflows that require Veraport.

Exploitation context

The supplied sources say remote code execution is possible, but do not provide exploit details. KEV is false, so there is no supplied evidence of known active exploitation. Attack conditions include network reachability, low privileges, and user interaction according to the CVSS vector.

Researcher notes

The source bundle is sparse: it identifies affected product, platform, impact, and CVSS, but not patch status, exploit maturity, affected CPEs, or CWE. Avoid assuming active exploitation or a specific fixed version without vendor confirmation.

Mitigation direction

  • Check WIZVERA or KR-CERT guidance for an official fix or replacement version.
  • Inventory macOS endpoints for WIZVERA Veraport G3 installations.
  • Remove or disable Veraport where it is not business-required.
  • Restrict Veraport use to trusted business workflows pending vendor guidance.
  • Monitor endpoints for unexpected downloads or execution by Veraport-related processes.

Validation and detection

  • Confirm whether any macOS endpoints have Veraport G3 installed.
  • Record installed versions and compare them with vendor or KR-CERT guidance.
  • Review endpoint telemetry for suspicious Veraport-initiated downloads or executions.
  • Verify whether Veraport is still required by current business processes.
  • Document compensating controls where immediate removal is not possible.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
description · low confidence lookup

File access behavior lookup

The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2018-5198 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8CVSS 3.0HighCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H2.15.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

8High
CVSS 3.0 vector shape for CVE-2018-5198Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
WIZVERAVeraportG3 allListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.