Lucene search

CiscoCVE-2018-0275

HistoryApr 19, 2018 - 8:29 p.m.

CVE-2018-0275

2018-04-1920:29:01

CWE-16

cisco

web.nvd.nist.gov

cisco

ise

vulnerability

support tunnel

local attacker

root access

cve-2018-0275

nvd

cisco bug ids

cscvf54409

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.5

Confidence

High

EPSS

Percentile

5.1%

JSON

A vulnerability in the support tunnel feature of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to access the device’s shell. The vulnerability is due to improper configuration of the support tunnel feature. An attacker could exploit this vulnerability by tricking the device into unlocking the support user account and accessing the tunnel password and device serial number. A successful exploit could allow the attacker to run any system command with root access. This affects Cisco Identity Services Engine (ISE) software versions prior to 2.2.0.470. Cisco Bug IDs: CSCvf54409.

Affected configurations

Nvd

Node

ciscoidentity_services_engineRange<2.2\(0.470\)

VendorProductVersionCPE
ciscoidentity_services_engine*cpe:2.3:h:cisco:identity_services_engine:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	identity_services_engine	*	cpe:2.3:h:cisco:identity_services_engine::::::::

CNA Affected

[
  {
    "product": "Cisco Identity Services Engine",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco Identity Services Engine"
      }
    ]
  }
]

References

www.securitytracker.com/id/1040717

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-ise

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.5

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2018-0275