vulnwire
9.8crit

CVE-2018-0253

A vulnerability in the ACS Report component of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
6.7%
percentile 94%
Public exploits
0
none known

A vulnerability in the ACS Report component of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected system. Commands executed by the attacker are processed at the targeted user's privilege level. The vulnerability is due to insufficient validation of the Action Message Format (AMF) protocol. An attacker could exploit this vulnerability by sending a crafted AMF message that contains malicious code to a targeted user. A successful exploit could allow the attacker to execute arbitrary commands on the ACS device. This vulnerability affects all releases of Cisco Secure ACS prior to Release 5.8 Patch 7. Cisco Bug IDs: CSCve69037.

CISA SSVC assessment

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
23 mo ago

Exploit prediction (EPSS)

6.72% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • n/a Cisco Secure Access Control System

Classification

Weakness
  • CWE-20 Improper Input Validation

References

  • securityfocus.com /bid/104075 · vdb-entry, x_refsource_BID, x_transferred
  • tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-acs1 · x_refsource_CONFIRM, x_transferred
  • securitytracker.com /id/1040808 · vdb-entry, x_refsource_SECTRACK, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.