Lucene search

CiscoCVE-2018-0333

HistoryJun 07, 2018 - 9:29 p.m.

CVE-2018-0333

2018-06-0721:29:00

CWE-693

cisco

web.nvd.nist.gov

cve-2018-0333

cisco

firesight

vpn

security

bypass

dynamic configuration

vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

40.7%

JSON

A vulnerability in the VPN configuration management of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass VPN security due to unintended side effects of dynamic configuration changes that could allow an attacker to bypass configured policies. The vulnerability is due to incorrect management of the configured interface names and VPN parameters when dynamic CLI configuration changes are performed. An attacker could exploit this vulnerability by sending packets through an interface on the targeted device. A successful exploit could allow the attacker to bypass configured VPN policies. Cisco Bug IDs: CSCvh49388.

Affected configurations

Nvd

Node

ciscofirepower_management_centerMatch6.2.2

VendorProductVersionCPE
ciscofirepower_management_center6.2.2cpe:2.3:a:cisco:firepower_management_center:6.2.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	firepower_management_center	6.2.2	cpe:2.3:a:cisco:firepower_management_center:6.2.2:::::::*

CNA Affected

[
  {
    "product": "Cisco FireSIGHT unknown",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco FireSIGHT unknown"
      }
    ]
  }
]

References

www.securityfocus.com/bid/104422

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-FireSIGHT-vpn-bypass

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

40.7%

JSON

Related for CVE-2018-0333