An authenticated multi‑stage vulnerability allows an attacker to establish a foothold in Riverbed SteelCentral NetProfiler and NetExpress 10.8.7 virtual appliances. Initially a SQL injection in the '/api/common/1.0/login' endpoint creates a new user account in the appliance database. The newly created user can then trigger a command injection through the '/index.php?page=licenses' endpoint, allowing arbitrary command execution. A weakness in the sudoers configuration further enables the malicious user to elevate privileges to root, yielding full control over the appliance. The impact is therefore a complete loss of confidentiality, integrity, and availability for the affected system, as the attacker can obtain full remote root access.

Riverbed Technology’s SteelCentral NetProfiler and SteelCentral NetExpress 10.8.7 virtual appliances are vulnerable; the issue is present in the appliance software distributed under these product names.

The CVSS score of 10 indicates critical severity, and the EPSS score of 50% shows a high likelihood that this flaw will be actively exploited. The vulnerability is not listed in the CISA KEV catalog, but the high exploitation probability and the multi‑stage attack path—requiring remote authenticated access, SQL injection, command injection, and sudoers exploitation—make it highly actionable. The attack vector is inferred to be remote, as the vulnerable endpoints are exposed on the appliance’s network interface.