7.8

CVE-2018-0302

A vulnerability in the CLI parser of Cisco FXOS Software and Cisco UCS Fabric Interconnect Software could allow an authenticated, local attacker to cause a buffer overflow on an affected device. The vulnerability is due to incorrect input validation in the CLI parser subsystem. An attacker could exploit this vulnerability by exceeding the expected length of user input. A successful exploit could allow the attacker to execute arbitrary code with root privileges on the affected system. This vulnerability affects Firepower 4100 Series Next-Generation Firewall, Firepower 9300 Security Appliance, UCS 6100 Series Fabric Interconnects, UCS 6200 Series Fabric Interconnects, UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvb61099, CSCvb86743.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Nx-os Version 3.1(1k)a
   Cisco ≫ Ucs 6120xp Version -
   Cisco ≫ Ucs 6140xp Version -
   Cisco ≫ Ucs 6248up Version -
   Cisco ≫ Ucs 6296up Version -
   Cisco ≫ Ucs 6324 Version -
   Cisco ≫ Ucs 6332 Version -
Cisco ≫ Firepower Extensible Operating System Version >= 1.1 < 1.1.4.169
   Cisco ≫ Firepower 4110 Version -
   Cisco ≫ Firepower 4120 Version -
   Cisco ≫ Firepower 4140 Version -
   Cisco ≫ Firepower 4150 Version -
Cisco ≫ Firepower Extensible Operating System Version >= 2.0 < 2.0.1.135
   Cisco ≫ Firepower 4110 Version -
   Cisco ≫ Firepower 4120 Version -
   Cisco ≫ Firepower 4140 Version -
   Cisco ≫ Firepower 4150 Version -
Cisco ≫ Firepower Extensible Operating System Version >= 1.1 < 1.1.4.169
Cisco ≫ Firepower Extensible Operating System Version >= 2.0 < 2.0.1.135
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.43% 0.35
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-fxos-ace
Vendor Advisory