CVE-2018-0376

CVE-2018-0376 affects Cisco Policy Suite prior to 18.2.0, in which the Policy Builder interface lacked authentication, allowing unauthenticated remote access to modify or create repositories. The vulnerability is documented with high/severe impact (CVSS v3.0: 9.8, CRITICAL) and was acknowledged b...

CVE-2021-40119

CVE-2021-40119 affects Cisco Policy Suite. The root cause is reuse of static SSH keys across installations, enabling an unauthenticated attacker to log in as root via SSH to vulnerable devices. Cisco issued advisories and software updates; starting with Policy Suite releases 21.2.0 and later, dev...

CVE-2018-0377

Cisco Policy Suite CVE-2018-0377 concerns an unauthenticated access vulnerability in the OSGi interface prior to release 18.1.0. Root cause: lack of authentication on the OSGi interface, enabling remote connections that could read or modify files accessible to the OSGi process. Impact per sources...

CVE-2018-0375

CVE-2018-0375 affects Cisco Policy Suite Cluster Manager prior to 18.2.0. Root cause: undocumented, static credentials allow an unauthenticated, remote attacker to log in as root and execute arbitrary commands. Impact: full root access over the affected system via network; high confidentiality, i...

CVE-2017-6623

CVE-2017-6623 describes a local privilege-escalation in Cisco Policy Suite (CPS) on CPS appliances. The root cause is incorrect sudoers permissions on a script file installed with CPS, enabling an authenticated local user to supply crafted CLI input and execute commands as root, thereby gaining r...

CVE-2017-6781

CVE-2017-6781 affects Cisco Policy Suite (CPS) on CPS appliances, stemming from incorrect RBAC in shell user accounts. An authenticated, local attacker can login with valid credentials and supply crafted CLI input to gain a higher privilege level (not root). Known affected CPS releases include 9....

CVE-2018-0089

The CVE-2018-0089 issue affects Cisco Policy Suite (CPS) PCRF. Affected component: PCRF within CPS. Root cause: incorrect permissions on certain system files, failing to protect sensitive data at rest. Impact: unauthenticated, remote attacker with access to the internal VLAN could request/view in...