CVE-2018-3969

An exploitable vulnerability exists in the verified boot protection of the CUJO Smart Firewall. It is possible to add arbitrary shell commands into the dhcpd.conf file, that persist across reboots and firmware updates, and thus allow for executing unverified commands. To trigger this vulnerability, a local attacker needs to be able to write into /config/dhcpd.conf.

• CWE-78

• https://talosintelligence.com/vulnerability_reports/TALOS-2018-0634Exploit, Third Party Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2018-0634Exploit, Third Party Advisory

Published

Mar 21, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-3963An exploitable command injection vulnerability exists in the…8
• CVE-2018-3964An exploitable use-after-free vulnerability exists in the Ja…7.8
• CVE-2018-3965An exploitable use-after-free vulnerability exists in the Ja…7.8
• CVE-2018-3966An exploitable use-after-free vulnerability exists in the Ja…7.8
• CVE-2018-3967An exploitable use-after-free vulnerability exists in the Ja…7.8
• CVE-2018-3968An exploitable vulnerability exists in the verified boot pro…7
• CVE-2018-3970An exploitable memory disclosure vulnerability exists in the…5.5
• CVE-2018-3971An exploitable arbitrary write vulnerability exists in the 0…7.8
• CVE-2018-3972An exploitable code execution vulnerability exists in the Le…9.8
• CVE-2018-3973An exploitable out of bounds write exists in the CAL parsing…7.8
• CVE-2018-3974An exploitable local privilege elevation vulnerability exist…7.8
• CVE-2018-3975An exploitable uninitialized variable vulnerability exists i…7.5