Lucene search

CiscoCVE-2018-0454

HistoryOct 05, 2018 - 2:29 p.m.

CVE-2018-0454

2018-10-0514:29:03

CWE-77

cisco

web.nvd.nist.gov

cve-2018-0454

cisco

csp 2100

web-based management

command injection

nvd

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

40.1%

JSON

A vulnerability in the web-based management interface of Cisco Cloud Services Platform 2100 could allow an authenticated, remote attacker to perform command injection. The vulnerability is due to insufficient input validation of command input. An attacker could exploit this vulnerability by sending customized commands to the web-based management interface.

Affected configurations

Nvd

Node

ciscocloud_services_platform_2100_firmwareMatch2.2\(4\)

AND

ciscocloud_services_platform_2100Match-

VendorProductVersionCPE
ciscocloud_services_platform_2100_firmware2.2(4)cpe:2.3:o:cisco:cloud_services_platform_2100_firmware:2.2\(4\):*:*:*:*:*:*:*
ciscocloud_services_platform_2100-cpe:2.3:h:cisco:cloud_services_platform_2100:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	cloud_services_platform_2100_firmware	2.2(4)	cpe:2.3:o:cisco:cloud_services_platform_2100_firmware:2.2\(4\):::::::*
cisco	cloud_services_platform_2100	-	cpe:2.3:h:cisco:cloud_services_platform_2100:-:::::::*

CNA Affected

[
  {
    "product": "Cisco Cloud Services Platform 2100",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

www.securitytracker.com/id/1041683

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-csp2100-injection

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

40.1%

JSON

Related for CVE-2018-0454