Lucene search

CiscoCVE-2018-0431

HistoryOct 05, 2018 - 2:29 p.m.

CVE-2018-0431

2018-10-0514:29:01

CWE-77

cisco

web.nvd.nist.gov

cisco

imc

vulnerability

remote attacker

arbitrary commands

root privileges

cve-2018-0431

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

32.8%

JSON

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject and execute arbitrary commands with root privileges on an affected device. The vulnerability is due to insufficient validation of command input by the affected software. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to inject and execute arbitrary, system-level commands with root privileges on an affected device.

Affected configurations

Nvd

Node

ciscounified_computing_systemMatch2.0_base

ciscounified_computing_systemMatch3.0\(3a\)

ciscounified_computing_systemMatch3.1\(3\)

VendorProductVersionCPE
ciscounified_computing_system2.0_basecpe:2.3:a:cisco:unified_computing_system:2.0_base:*:*:*:*:*:*:*
ciscounified_computing_system3.0(3a)cpe:2.3:a:cisco:unified_computing_system:3.0\(3a\):*:*:*:*:*:*:*
ciscounified_computing_system3.1(3)cpe:2.3:a:cisco:unified_computing_system:3.1\(3\):*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	unified_computing_system	2.0_base	cpe:2.3:a:cisco:unified_computing_system:2.0_base:::::::*
cisco	unified_computing_system	3.0(3a)	cpe:2.3:a:cisco:unified_computing_system:3.0\(3a\):::::::*
cisco	unified_computing_system	3.1(3)	cpe:2.3:a:cisco:unified_computing_system:3.1\(3\):::::::*

CNA Affected

[
  {
    "product": "Cisco Unified Computing System E-Series Software (UCSE)",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

www.securitytracker.com/id/1041686

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-cimc-injection

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

32.8%

JSON

Related for CVE-2018-0431