CVE-2018-25117
UNSCOREDDescription
VestaCP commit a3f0fa1 (2018-05-31) up to commit ee03eff (2018-06-13) contain embedded malicious code that resulted in a supply-chain compromise. New installations created from the compromised installer since at least May 2018 were subject to installation of Linux/ChachaDDoS, a multi-stage DDoS bot that uses Lua for second- and third-stage components. The compromise leaked administrative credentials (base64-encoded admin password and server domain) to an external URL during installation and/or resulted in the installer dropping and executing a DDoS malware payload under local system privileges. Compromised servers were subsequently observed participating in large-scale DDoS activity. Vesta acknowledged exploitation in the wild in October 2018.
How to fix
No published remediation has been found for this vulnerability's affected products yet.
Mitigation guidance may be in the linked vendor advisories in the References section below.
TridentStack Control tracks known vulnerabilities across your Windows, macOS, and Linux fleet and shows the fix as soon as one is published. See how it works
CVSS v3.1 Vector
No CVSS vector data available.
Exploit Intelligence
Low risk: more likely to be exploited than 33% of all known CVEs.
References
Related Vulnerabilities
Other CWE-506 vulnerabilities, ordered by exploit likelihood. View all
| CVE | Severity | CVSS | EPSS | Exploited | Fix |
|---|---|---|---|---|---|
| CVE-2024-3094 | Critical | 10.0 | 86% | - | Fix |
| CVE-2026-33634 | High | 8.8 | 60% | KEV | Fix |
| CVE-2025-30066 | High | 8.6 | 41% | KEV | - |
| CVE-2024-4978 | High | 8.4 | 27% | KEV | - |
| CVE-2025-54313 | High | 7.5 | 4.1% | KEV | Fix |
| CVE-2026-45321 | Critical | 9.6 | 2.3% | KEV + Ransom | - |
Embed a live status badge for CVE-2018-25117
Markdown
[](https://tridentstack.com/cve/CVE-2018-25117)HTML
<a href="https://tridentstack.com/cve/CVE-2018-25117"><img src="https://tridentstack.com/cve/badge/CVE-2018-25117.svg" alt="CVE-2018-25117"></a>Find and fix vulnerabilities across your fleet
TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.
This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-10-16.