Cisco Immunet and Cisco AMP for Endpoints System Scan Denial of Service Vulnerability

Published 8 y ago 2018-11-08 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.5

v3.0 · CNA

CISA KEV

not known exploited

EPSS

1.0%

percentile 62%

Public exploits

Exploit-DB

A vulnerability in the system scanning component of Cisco Immunet and Cisco Advanced Malware Protection (AMP) for Endpoints running on Microsoft Windows could allow a local attacker to disable the scanning functionality of the product. This could allow executable files to be launched on the system without being analyzed for threats. The vulnerability is due to improper process resource handling. An attacker could exploit this vulnerability by gaining local access to a system running Microsoft Windows and protected by Cisco Immunet or Cisco AMP for Endpoints and executing a malicious file. A successful exploit could allow the attacker to prevent the scanning services from functioning properly and ultimately prevent the system from being protected from further intrusion.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 23 mo ago 2024-11-25

Exploit prediction (EPSS)

0.97% probability of exploitation in the next 30 days, higher than 62% of all scored CVEs.

Exploits and detections

EDB-45829 Cisco Immunet < 6.2.0 / Cisco AMP For Endpoints 6.2.0 - Denial of Service · dos · 2018-11-13

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	5.5	`CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`
NVD	3.1	5.5	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N`
CNA	3.0	5.5	`CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`
NVD	2.0	2.1	`AV:L/AC:L/Au:N/C:N/I:P/A:N`

Affected products

Cisco Cisco AMP for Endpoints

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption

References

securityfocus.com /bid/105867 · vdb-entry, x_refsource_BID, x_transferred
tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-imm-dos · vendor-advisory, x_refsource_CISCO, x_transferred
exploit-db.com /exploits/45829/ · exploit, x_refsource_EXPLOIT-DB, x_transferred

Sources

CVE List: CVE-2018-15437
NVD: CVE-2018-15437

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary