Lucene search

[email protected]CVE-2018-0344

HistoryJul 18, 2018 - 11:29 p.m.

CVE-2018-0344

2018-07-1823:29:00

CWE-77

[email protected]

web.nvd.nist.gov

vmanage

cisco sd-wan

vulnerability

remote attacker

arbitrary commands

vmanage user privileges

input validation

cisco bug ids

nvd

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.7%

JSON

A vulnerability in the vManage dashboard for the configuration and management service of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject and execute arbitrary commands with vmanage user privileges on an affected system. The vulnerability is due to insufficient input validation of data parameters for certain fields in the affected solution. An attacker could exploit this vulnerability by configuring a malicious username on the login page of the affected solution. A successful exploit could allow the attacker to inject and execute arbitrary commands with vmanage user privileges on an affected system. This vulnerability affects the following Cisco products if they are running a release of the Cisco SD-WAN Solution prior to Release 18.3.0: vBond Orchestrator Software, vEdge 100 Series Routers, vEdge 1000 Series Routers, vEdge 2000 Series Routers, vEdge 5000 Series Routers, vEdge Cloud Router Platform, vManage Network Management Software, vSmart Controller Software. Cisco Bug IDs: CSCvi69974.

Affected configurations

NVD

Node

ciscovbond_orchestratorMatch-

ciscovedge-plusMatch-

ciscovedge-proMatch-

ciscovmanage_network_managementMatch-

ciscovsmart_controllerMatch-

Node

ciscovedge-100_firmwareRange<18.3.0

AND

ciscovedge-100Match-

Node

ciscovedge_100b_firmwareRange<18.3.0

AND

ciscovedge_100bMatch-

Node

ciscovedge_100m_firmwareRange<18.3.0

AND

ciscovedge_100mMatch-

Node

ciscovedge_100wm_firmwareRange<18.3.0

AND

ciscovedge_100wmMatch-

Node

ciscovedge-1000_firmwareRange<18.3.0

AND

ciscovedge-1000Match-

Node

ciscovedge-2000_firmwareRange<18.3.0

AND

ciscovedge-2000Match-

Node

ciscovedge-5000_firmwareRange<18.3.0

AND

ciscovedge-5000Match-

CPENameOperatorVersion
cisco:vbond_orchestratorcisco vbond orchestratoreq-
cisco:vedge-pluscisco vedge-pluseq-
cisco:vedge-procisco vedge-proeq-
cisco:vmanage_network_managementcisco vmanage network managementeq-
cisco:vsmart_controllercisco vsmart controllereq-

CPE	Name	Operator	Version
cisco:vbond_orchestrator	cisco vbond orchestrator	eq	-
cisco:vedge-plus	cisco vedge-plus	eq	-
cisco:vedge-pro	cisco vedge-pro	eq	-
cisco:vmanage_network_management	cisco vmanage network management	eq	-
cisco:vsmart_controller	cisco vsmart controller	eq	-

CNA Affected

[
  {
    "product": "Cisco SD-WAN Solution unknown",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco SD-WAN Solution unknown"
      }
    ]
  }
]

References

www.securityfocus.com/bid/104868

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-sd-wan-cmd-inject

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.7%

JSON

Related for CVE-2018-0344

cvelist1 cisco1 prion1 nvd1