The vulnerability of the Cisco Secure Access Control System’s access control software lies in the ability to restore a questionable data structure in memory, allowing an intruder to execute arbitrary commands with root privileges.

🗓️ 19 Apr 2018 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru

Remote code execution on Cisco ACS via crafted serialized Java object due to input validation failure, enabling root privileges.

Reporter	Title	Published	Views	Family All 18
ATTACKERKB	CVE-2018-0147	8 Mar 201800:00	–	attackerkb
Circl	CVE-2018-0147	19 Dec 202217:20	–	circl
CISA KEV Catalog	Cisco Secure Access Control System Java Deserialization Vulnerability	25 Mar 202200:00	–	cisa_kev
Cisco	Cisco Secure Access Control System Java Deserialization Vulnerability	7 Mar 201816:00	–	cisco
Tenable Nessus	Cisco Secure Access Control Multiple Vulnerabilities (cisco-sa-20180307-acs1 / cisco-sa-20180307-acs2)	16 Mar 201800:00	–	nessus
CNVD	Cisco Secure Access Control System Java Deserialization Vulnerability	8 Mar 201800:00	–	cnvd
CVE	CVE-2018-0147	8 Mar 201807:00	–	cve
Cvelist	CVE-2018-0147	8 Mar 201807:00	–	cvelist
myhack58	Cisco products in the presence of severe hard-coded password vulnerabilities and Java deserialization vulnerability-vulnerability warning-the black bar safety net	9 Mar 201800:00	–	myhack58
NVD	CVE-2018-0147	8 Mar 201807:29	–	nvd

Source	Link
securityfocus	www.securityfocus.com/bid/103328
securitytracker	www.securitytracker.com/id/1040463
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-acs2
cisa	www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv
web	www.web.nvd.nist.gov/view/vuln/detail

24 Sep 2024 00:00Current

7.6High risk

Vulners AI Score7.6

CVSS 39.8

CVSS 210

EPSS0.03952

remote execution serialized Java object input validation failure root privileges memory data structure