CVE-2018-25225

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2018-25225
SIPP 3.3 contains a stack-based buffer overflow vulnerability that allows local unauthenticated attackers to execute arbitrary code by supplying malicious input in the configuration file. Attackers can craft a configuration file with oversized values that overflow a stack buffer, overwriting the return address and executing arbitrary code through return-oriented programming gadgets.

8.4 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://sipp.sourceforge.net/ Product
https://www.exploit-db.com/exploits/45288 Exploit VDB Entry
https://www.vulncheck.com/advisories/sipp-stack-based-buffer-overflow-via-configuration-file Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:sipp_project:sipp:3.3:*:*:*:*:*:*:*
History

08 Apr 2026, 19:36

Type Values Removed Values Added
References () http://sipp.sourceforge.net/ - () http://sipp.sourceforge.net/ - Product
References () https://www.exploit-db.com/exploits/45288 - () https://www.exploit-db.com/exploits/45288 - Exploit, VDB Entry
References () https://www.vulncheck.com/advisories/sipp-stack-based-buffer-overflow-via-configuration-file - () https://www.vulncheck.com/advisories/sipp-stack-based-buffer-overflow-via-configuration-file - Third Party Advisory
Summary
  • (es) SIPP 3.3 contiene una vulnerabilidad de desbordamiento de búfer basado en pila que permite a atacantes locales no autenticados ejecutar código arbitrario al proporcionar entrada maliciosa en el archivo de configuración. Los atacantes pueden crear un archivo de configuración con valores sobredimensionados que desbordan un búfer de pila, sobrescribiendo la dirección de retorno y ejecutando código arbitrario a través de gadgets de programación orientada a retorno.
First Time Sipp Project sipp
Sipp Project
CPE cpe:2.3:a:sipp_project:sipp:3.3:*:*:*:*:*:*:*

28 Mar 2026, 12:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-28 12:16

Updated : 2026-04-08 19:36

NVD link : CVE-2018-25225

Mitre link : CVE-2018-25225

CVE.ORG link : CVE-2018-25225

JSON object : View

Products Affected

sipp_project

  • sipp
CWE
CWE-306

Missing Authentication for Critical Function