CVE-2018-0122
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authenticated, local attacker to overwrite system files that are stored in the flash memory of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the affected operating system. An attacker could exploit this vulnerability by injecting crafted command arguments into a vulnerable CLI command for the affected operating system. A successful exploit could allow the attacker to overwrite or modify arbitrary files that are stored in the flash memory of an affected system. To exploit this vulnerability, the attacker would need to authenticate to an affected system by using valid administrator credentials. Cisco Bug IDs: CSCvf93335.
Una vulnerabilidad en el CLI del sistema operativo Cisco StarOS para routers Cisco ASR 5000 Series Aggregation Services podría permitir que un atacante local autenticado sobrescriba archivos de sistema almacenados en la memoria flash de un sistema afectado. La vulnerabilidad se debe a la validación insuficiente de entrada de datos de parte del usuario por parte del sistema afectado. Un atacante podría explotar esta vulnerabilidad inyectando argumentos de comando manipulados en un comando de interfaz de línea de comandos vulnerable en el sistema operativo afectado. Si se explota esta vulnerabilidad con éxito, el atacante podría sobrescribir o modificar archivos arbitrarios almacenados en la memoria flash de un sistema afectado. Para explotar esta vulnerabilidad, el atacante necesitaría autenticarse en el sistema afectado empleando credenciales de administrador válidas. Cisco Bug IDs: CSCvf93335.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-11-27 CVE Reserved
- 2018-02-08 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/103028 | Third Party Advisory | |
| http://www.securitytracker.com/id/1040340 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-asr | 2020-09-04 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Cisco Search vendor "Cisco" | Staros Search vendor "Cisco" for product "Staros" | 21.3.0.67664 Search vendor "Cisco" for product "Staros" and version "21.3.0.67664" | - |
Affected
| in | Cisco Search vendor "Cisco" | Asr 5000 Search vendor "Cisco" for product "Asr 5000" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Staros Search vendor "Cisco" for product "Staros" | 21.3.0.67664 Search vendor "Cisco" for product "Staros" and version "21.3.0.67664" | - |
Affected
| in | Cisco Search vendor "Cisco" | Asr 5500 Search vendor "Cisco" for product "Asr 5500" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Staros Search vendor "Cisco" for product "Staros" | 21.3.0.67664 Search vendor "Cisco" for product "Staros" and version "21.3.0.67664" | - |
Affected
| in | Cisco Search vendor "Cisco" | Asr 5700 Search vendor "Cisco" for product "Asr 5700" | - | - |
Safe
|