CVE-2018-25320 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2018-25320 requires immediate attention.

· 8 min read

Executive Summary

CVE-2018-25320 is a critical remote code execution vulnerability in ACL Analytics versions 11.x through 13.0.0.579 with a CVSS score of 9.8. An attacker who can reach a vulnerable installation may abuse the EXECUTE function to run arbitrary commands as the application’s system-level account. In practical terms, this can be used to download and run malicious PowerShell via bitsadmin, establish a reverse shell, and take full control of the host.

This issue is not currently known to be exploited in the wild and is not in CISA KEV, but the impact is severe enough that solo developers and small teams should treat it as an emergency if ACL Analytics is present anywhere in their environment.

Immediate Action

  • Identify and isolate any system running ACL Analytics 11.x–13.0.0.579. If the product is internet-facing, remove exposure immediately or place it behind VPN/restrictive network controls.
  • Upgrade to the vendor-fixed release as soon as possible. If you do not know the safe version, use the vendor advisory and patch notes to confirm the first non-vulnerable build: Vendor advisory / security bulletin.
  • Temporarily disable or restrict the EXECUTE function if your workflow allows it. Remove access for non-admin users and audit any scripts or jobs that invoke it.
  • Back up critical data and configs before patching, then snapshot or image the host so you can recover quickly if compromise is found.
  • Check for signs of abuse: unexpected PowerShell, bitsadmin, reverse shells, new local admin accounts, or unfamiliar scheduled tasks/services.
  • If compromise is suspected, disconnect the host, preserve logs, and rotate credentials that may have been exposed on that machine.

Affected Versions

  • ACL Analytics 11.x vulnerable
  • ACL Analytics 12.x vulnerable
  • ACL Analytics 13.0.0.579 vulnerable
  • ACL Analytics <= 13.0.0.579 vulnerable
  • ACL Analytics >= TODO_FIXED_VERSION safe, if confirmed by vendor advisory

Note: If your installed build is not explicitly documented as fixed, assume it is vulnerable until verified against the vendor’s security bulletin.

Resolution Guide

ACL Analytics is not typically managed through npm, pip, Maven, or Linux package managers, so the main remediation is to patch the vendor application directly. The commands below are included for teams that may have wrappers, automation, or containerized deployments around the product.

# Windows: inventory installed version
wmic product where "name like 'ACL Analytics%'" get Name,Version

# Windows: locate ACL installation paths and scripts
where /r "C:\Program Files" *acl*
where /r "C:\Program Files (x86)" *acl*

# Windows: check for suspicious PowerShell / bitsadmin usage in recent logs
wevtutil qe Security /f:text /c:50
wevtutil qe Microsoft-Windows-PowerShell/Operational /f:text /c:50

JavaScript / Python / Java / Linux package managers are not direct remediation paths for ACL Analytics, but if your team wraps the product in tooling, update those dependencies too:

# npm / yarn / pnpm examples for any internal tooling
npm audit
npm i <package>@TODO_FIXED_VERSION
yarn upgrade <package>@TODO_FIXED_VERSION
pnpm up <package>@TODO_FIXED_VERSION

# Python
pip install --upgrade <package>==TODO_FIXED_VERSION
pipx upgrade <tool>

# Java
mvn versions:use-latest-releases
./gradlew dependencyUpdates

# Linux package managers
sudo apt update
sudo apt install --only-upgrade <package>
sudo yum update <package>

# Docker image tags
docker pull <vendor-image>:TODO_FIXED_TAG
docker run --rm <vendor-image>:TODO_FIXED_TAG

Config hardening:

# Example: disable dangerous execution paths in app config
EXECUTE_ENABLED=false
ALLOW_SCRIPT_EXECUTION=false
RESTRICT_ADMIN_FUNCTIONS=true

# Example: network containment
# Only allow trusted admin IPs to reach the service
# Windows Firewall / security group / reverse proxy allowlist

Minimal code fix pattern if you maintain a wrapper or plugin that calls EXECUTE: remove direct shell execution and enforce an allowlist.

// BAD: direct command execution
runExecute(userInput);

// BETTER: allowlist only known-safe actions
const allowed = new Set(["export-report", "sync-data"]);
if (!allowed.has(action)) throw new Error("Action not allowed");
dispatchSafeAction(action);

Detection & Verification

Check whether you are vulnerable:

  • Confirm installed ACL Analytics version from the application UI, installer metadata, or Windows inventory commands.
  • Search for use of EXECUTE in scripts, jobs, and templates.
  • Look for suspicious child processes spawned by ACL Analytics, especially cmd.exe, powershell.exe, bitsadmin.exe, curl.exe, or wscript.exe.
# Search ACL-related files for EXECUTE usage
findstr /s /i "EXECUTE" "C:\Program Files\ACL*\*.txt" "C:\Program Files\ACL*\*.acl"

# PowerShell: find suspicious process creation
Get-WinEvent -LogName Security -MaxEvents 200 |
  Where-Object {$_.Id -eq 4688} |
  Select-Object -First 20 | Format-List

# Check for bitsadmin usage
Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational -MaxEvents 200 |
  Select-String -Pattern "bitsadmin|powershell|reverse shell"

Verify the fix:

# Re-check version after patching
wmic product where "name like 'ACL Analytics%'" get Name,Version

# Confirm EXECUTE is disabled or inaccessible
# Try a non-destructive test in a staging environment only
# Expect the action to be blocked or rejected by policy/config

# Confirm no suspicious recent process chains
Get-CimInstance Win32_Process |
  Select-Object Name,ParentProcessId,ProcessId,CommandLine |
  Sort-Object Name

Risk and Impact

This vulnerability can give an attacker full command execution with system privileges on the affected host. That means data theft, malware installation, credential dumping, lateral movement, and persistence are all possible if the system is reachable and the flaw is triggered successfully.

For small teams, the blast radius can be larger than it looks: one compromised analytics workstation or server can expose shared files, secrets, API keys, and internal network access. If ACL Analytics is used on a machine with elevated permissions or access to production data, treat this as a high-priority containment and patching event.

Keep reading