A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user.

Published 8 y ago 2018-07-18 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.5

v3.0 · NVD

CISA KEV

not known exploited

EPSS

0.3%

percentile 22%

Public exploits

none known

A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulnerability is due to insufficient access control permissions (i.e., World-Readable). An attacker could exploit this vulnerability by logging in to the CLI. An exploit could allow the attacker to access potentially sensitive files that are owned by a different user. Cisco Bug IDs: CSCvh18087.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 23 mo ago 2024-11-29

Exploit prediction (EPSS)

0.29% probability of exploitation in the next 30 days, higher than 22% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	5.5	`CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	2.1	`AV:L/AC:L/Au:N/C:P/I:N/A:N`

Affected products

n/a Cisco Policy Suite unknown

Classification

Weakness

CWE-275 Permission Issues
CWE-732 Incorrect Permission Assignment for Critical Resource

References

securityfocus.com /bid/104866 · vdb-entry, x_refsource_BID, x_transferred
tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-policy-suite-data · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2018-0392
NVD: CVE-2018-0392

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary