{"cve":"CVE-2018-10239","nvd":{"published":"2019-06-17T15:15:12.003","modified":"2026-06-17T01:33:44.693","status":"Modified","description":"A privilege escalation vulnerability in the \"support access\" feature on Infoblox NIOS 6.8 through 8.4.1 could allow a locally authenticated administrator to temporarily gain additional privileges on an affected device and perform actions within the super user scope. The vulnerability is due to a weakness in the \"support access\" password generation algorithm. A locally authenticated administrative user may be able to exploit this vulnerability if the \"support access\" feature is enabled, they know the support access code for the current session, and they know the algorithm to generate the support access password from the support access code. \"Support access\" is disabled by default. When enabled, the access will be automatically disabled (and support access code will expire) after the 24 hours.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":6.7},"cwes":["CWE-264"],"references":["https://community.infoblox.com/t5/Security-Blog/10427-NIOS-Privilege-Escalation-Vulnerability/ba-p/17309","https://community.infoblox.com/t5/Security-Blog/10427-NIOS-Privilege-Escalation-Vulnerability/ba-p/17309"],"products":["infoblox:nios"],"source":"nvd","synced_at":"2026-10-19T20:57:00.690689396+00:00"},"epss":{"cve":"CVE-2018-10239","score":0.00379,"percentile":0.31889,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}