7.8

CVE-2018-0298

A vulnerability in the web UI of Cisco FXOS and Cisco UCS Fabric Interconnect Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected system. The vulnerability is due to incorrect input validation in the web UI. An attacker could exploit this vulnerability by sending a malicious HTTP or HTTPS packet directed to the physical management interface of an affected system. A successful exploit could allow the attacker to cause the process to crash and possibly reload the device, resulting in a denial of service (DoS) condition on the affected system. This vulnerability affects Firepower 4100 Series Next-Generation Firewall, Firepower 9300 Security Appliance, UCS 6200 Series Fabric Interconnects, UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvb61398, CSCvb86799.

Data is provided by the National Vulnerability Database (NVD)
Cisco ≫ Nx-os Version >= 3.0\(2\) < 3.1\(3a\)a
   Cisco ≫ Ucs 6120xp Version-
   Cisco ≫ Ucs 6140xp Version-
   Cisco ≫ Ucs 6248up Version-
   Cisco ≫ Ucs 6296up Version-
   Cisco ≫ Ucs 6324 Version-
   Cisco ≫ Ucs 6332 Version-
Cisco ≫ Firepower Extensible Operating System Version >= 1.1 < 1.1.4.169
   Cisco ≫ Firepower 4110 Version-
   Cisco ≫ Firepower 4120 Version-
   Cisco ≫ Firepower 4140 Version-
   Cisco ≫ Firepower 4150 Version-
Cisco ≫ Firepower Extensible Operating System Version >= 2.0 < 2.0.1.135
   Cisco ≫ Firepower 4110 Version-
   Cisco ≫ Firepower 4120 Version-
   Cisco ≫ Firepower 4140 Version-
   Cisco ≫ Firepower 4150 Version-
Cisco ≫ Firepower Extensible Operating System Version >= 1.1 < 1.1.4.179
Cisco ≫ Firepower Extensible Operating System Version >= 2.0 < 2.0.1.153
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 1.33% 0.781
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 7.8 10 6.9
AV:N/AC:L/Au:N/C:N/I:N/A:C
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.