Read the docs
TI-2018-07263 Aliases CVE-2018-10239GHSA-5x64-6cf8-m3mw

A privilege escalation vulnerability in the "support access" feature on Infoblox NIOS 6.8…

Priority LOW 30CWE-264Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

A privilege escalation vulnerability in the "support access" feature on Infoblox NIOS 6.8 through 8.4.1 could allow a locally authenticated administrator to temporarily gain additional privileges on an affected device and perform actions within the super user scope. The vulnerability is due to a weakness in the "support access" password generation algorithm. A locally authenticated administrative user may be able to exploit this vulnerability if the "support access" feature is enabled, they know the support access code for the current session, and they know the algorithm to generate the support access password from the support access code. "Support access" is disabled by default. When enabled, the access will be automatically disabled (and support access code will expire) after the 24 hours.

Why it matters now

EPSS 0.00379 32nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:infoblox:nios:*:*:*:*:*:*:*:*6.8 – 8.4.1VulnerableInfoblox
  • cpe:2.3:o:infoblox:nios:*:*:*:*:*:*:*:* Versions 6.8 – 8.4.1 Vulnerable ·Infoblox

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-10239
  2. 2026-10-03 Alias added: GHSA-5x64-6cf8-m3mw

References

Advisory 1

  • TI-2022-11560 A stored cross-site scripting (XSS) vulnerability in Infoblox NIOS v8.5.2-409296 allows… CVSS 3.1MEDIUM 5.4
  • TI-2024-25066 Infoblox NIOS through 8.6.4 has Improper Authentication for Grids. CVSS 3.1CRITICAL 9.8
  • TI-2024-23901 Infoblox NIOS through 8.6.4 and 9.x through 9.0.3 has Improper Input Validation. CVSS 3.1CRITICAL 9.8
  • TI-2024-23900 Infoblox NIOS through 8.6.4 executes with more privileges than required. CVSS 3.1CRITICAL 9.8
  • TI-2024-25067 Infoblox NIOS through 8.6.4 has Improper Access Control for Grids. CVSS 3.1CRITICAL 9.1
  • TI-2025-38250 In Infoblox NIOS through 9.0.7, insecure deserialization can result in remote code execution. CVSS 3.1HIGH 8.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences