CVE-2018-0169
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Linux shell of an affected device and execute arbitrary commands with root privileges on the device. The vulnerabilities are due to the affected software improperly sanitizing command arguments to prevent access to internal data structures on a device. An attacker who has user EXEC mode (privilege level 1) access to an affected device could exploit these vulnerabilities on the device by executing CLI commands that contain crafted arguments. A successful exploit could allow the attacker to gain access to the underlying Linux shell of the affected device and execute arbitrary commands with root privileges on the device. Cisco Bug IDs: CSCtw85441, CSCus42252, CSCuv95370.
Múltiples vulnerabilidades en el analizador CLI de Cisco IOS XE Software podrían permitir que un atacante local autenticado obtenga acceso al shell Linux subyacente de un dispositivo afectado y ejecute comandos arbitrarios con privilegios root en el dispositivo. Las vulnerabilidades se deben a que el software afectado sanea incorrectamente los argumentos de comando para evitar el acceso a las estructuras de datos internas de un dispositivo. Un atacante que tenga acceso de usuario en modo EXEC (nivel 1 de privilegios) a un dispositivo afectado podría explotar estas vulnerabilidades en el dispositivo ejecutando comandos CLI que contienen argumentos manipulados. Su explotación con éxito podría permitir que el atacante obtenga acceso al shell Linux subyacente del dispositivo afectado y ejecute comandos arbitrarios con privilegios root en el dispositivo. Cisco Bug IDs: CSCtw85441, CSCus42252, CSCuv95370.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-11-27 CVE Reserved
- 2018-03-28 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (3)
URL | Tag | Source |
---|---|---|
http://www.securityfocus.com/bid/103567 | Third Party Advisory | |
http://www.securitytracker.com/id/1040583 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-privesc1 | 2019-10-09 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Cisco Search vendor "Cisco" | Ios Search vendor "Cisco" for product "Ios" | 15.0\(5.59\)emd Search vendor "Cisco" for product "Ios" and version "15.0\(5.59\)emd" | - |
Affected
|