HomeAdvisoriesPOSIM EVO for Windows

POSIM EVO for Windows

Client Login "Override"

CVE ID

CVE-2018-15807

Vendor

POSIM, LLC

Product

POSIM EVO for Windows

Product Version

15.13

Vulnerability Details

POSIM EVO for Windows includes an “Emergency Override” administrative account that may be accessed through POSIM’s “override” feature. This Override prompt expects a code that is computed locally using a deterministic algorithm. This code may be generated by an attacker and used to bypass any POSIM EVO login prompt.

Learn more

Vendor Response

POSIM has not remediated the vulnerability.

Disclosure Timeline

  • Disclosed to Vendor

  • Disclosures forwarded to development

  • Development still working on both issues

  • No updates from vendor

  • Publicly disclosed at BSides ATL