Loading vulnerability…
CVE-2018-17888 is a vulnerability in NUUO Central Management Server (CMS) versions 3.1 and prior, where the application uses a session identification mechanism based on predictable values (heap addresses) for session tokens. This allows attackers to brute-force or guess valid session IDs, hijack active sessions, and potentially execute arbitrary remote code if the session belongs to an administrator or privileged user. The vulnerability is present in all versions below 2.4.0 and is exacerbated by the lack of brute-force protection on the CMS server.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Metasploit auxiliary module: 'nuuo_cms_bruteforce.rb'. The module targets NUUO Central Management Server (CMS) versions below 2.4, exploiting a flaw in the session token generation mechanism (CVE-2018-17888). The exploit leverages statistical analysis of session token patterns to efficiently brute-force a valid user session token, reducing the keyspace from millions to a manageable number of attempts. The module requires a user to be logged in on the target CMS and, upon success, provides a valid session token that can be used for further exploitation (such as code execution or file download) with other Metasploit modules. The code is written in Ruby and is designed to be run within the Metasploit framework, using its remote communication and reporting capabilities. No hardcoded IPs, URLs, or file paths are present; the target endpoint is specified by the user when configuring the module. The repository is operational in maturity, providing a working exploit for session token discovery rather than just a proof of concept.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
No public activity tracked yet. Mallory keeps watching.
No public activity observed for this vulnerability.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.