Lucene search

CiscoCVE-2018-15387

HistoryOct 05, 2018 - 2:29 p.m.

CVE-2018-15387

2018-10-0514:29:07

CWE-295

CWE-20

cisco

web.nvd.nist.gov

cve-2018-15387

cisco

sd-wan

vulnerability

certificate validation

remote attacker

nvd

exploit

system image

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.002

Percentile

55.4%

JSON

A vulnerability in the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass certificate validation on an affected device. The vulnerability is due to improper certificate validation. An attacker could exploit this vulnerability by supplying a system image signed with a crafted certificate to an affected device, bypassing the certificate validation. An exploit could allow an attacker to deploy a crafted system image.

Affected configurations

Nvd

Node

ciscosd-wanRange17.2.0–17.2.8

ciscosd-wanMatch18.3.0

VendorProductVersionCPE
ciscosd-wan*cpe:2.3:a:cisco:sd-wan:*:*:*:*:*:*:*:*
ciscosd-wan18.3.0cpe:2.3:a:cisco:sd-wan:18.3.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	sd-wan	*	cpe:2.3:a:cisco:sd-wan::::::::
cisco	sd-wan	18.3.0	cpe:2.3:a:cisco:sd-wan:18.3.0:::::::*

CNA Affected

[
  {
    "product": "Cisco SD-WAN Solution",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

www.securityfocus.com/bid/105509

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-sd-wan-bypass

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.002

Percentile

55.4%

JSON

Related for CVE-2018-15387