10

CVE-2018-0253

A vulnerability in the ACS Report component of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected system. Commands executed by the attacker are processed at the targeted user's privilege level. The vulnerability is due to insufficient validation of the Action Message Format (AMF) protocol. An attacker could exploit this vulnerability by sending a crafted AMF message that contains malicious code to a targeted user. A successful exploit could allow the attacker to execute arbitrary commands on the ACS device. This vulnerability affects all releases of Cisco Secure ACS prior to Release 5.8 Patch 7. Cisco Bug IDs: CSCve69037.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Secure Access Control System Version5.8 Updatep1
Cisco ≫ Secure Access Control System Version5.8 Updatep2
Cisco ≫ Secure Access Control System Version5.8 Updatep3
Cisco ≫ Secure Access Control System Version5.8 Updatep4
Cisco ≫ Secure Access Control System Version5.8 Updatep6
Cisco ≫ Secure Access Control System Version5.8(0.8)
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.51% 0.887
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.securityfocus.com/bid/104075
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1040808
Third Party Advisory
VDB Entry