TI-2011-03684 Aliases CVE-2011-4182 GHSA-2w7f-37f7-67q3

shell code injection via ESSID because of missing escaping of a variable

LOW 39CWE-77Published 2018-06-12 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-77.

Summary

Missing escaping of ESSID values in sysconfig of SUSE Linux Enterprise allows attackers controlling an access point to cause execute arbitrary code. Affected releases are sysconfig prior to 0.83.7-2.1.

Why it matters now

EPSS 0.01757 78th percentileScored 2026-11-07

Fix Fixed sysconfig (SUSE Linux Enterprise): 0.83.7-2.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SUSE Linux Enterprise	sysconfig	before 0.83.7-2.1	0.83.7-2.1	Patch available	CNA

sysconfig VendorSUSE Linux Enterprise Affected before 0.83.7-2.1 Fixed in 0.83.7-2.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:opensuse:sysconfig::::::::	up to 0.83.7	Vulnerable	openSUSE

cpe:2.3:a:opensuse:sysconfig:*:*:*:*:*:*:*:* Versions up to 0.83.7 Vulnerable ·openSUSE

Remediation

Fix · CNA sysconfig (SUSE Linux Enterprise) Fixed in 0.83.7-2.1

Timeline

2026-10-02 Threatist record created from CVE-2011-4182
2026-10-03 Alias added: GHSA-2w7f-37f7-67q3

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences