// For flags

CVE-2018-0181

Cisco Policy Suite for Mobile and Cisco Policy Suite Diameter Routing Agent Software Redis Server Unauthenticated Access Vulnerability

Severity Score

9.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

A vulnerability in the Redis implementation used by the Cisco Policy Suite for Mobile and Cisco Policy Suite Diameter Routing Agent software could allow an unauthenticated, remote attacker to modify key-value pairs for short-lived events stored by the Redis server. The vulnerability is due to improper authentication when accessing the Redis server. An unauthenticated attacker could exploit this vulnerability by modifying key-value pairs stored within the Redis server database. An exploit could allow the attacker to reduce the efficiency of the Cisco Policy Suite for Mobile and Cisco Policy Suite Diameter Routing Agent software.

Una vulnerabilidad en la implementación Redis, utilizada por los software Cisco Policy Suite for Mobile y Cisco Policy Suite Diameter Routing Agent, podría permitir un usuario remoto sin autenticar modificar pares de valores de clave para eventos de corta duración almacenados por el servidor Redis. La vulnerabilidad se debe a una autorización incorrecta cuando se accede al servidor de Redis. Un atacante no autenticado podría explotar esta vulnerabilidad modificando los pares de valores de clave almacenados en la base de datos de Redis. Un exploit podría permitir al atacante reducir la eficacia del software del agente de router "Cisco Policy Suite for Mobile and Cisco Policy Suite Diameter".

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2017-11-27 CVE Reserved
  • 2019-01-10 CVE Published
  • 2024-06-01 EPSS Updated
  • 2024-11-19 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-306: Missing Authentication for Critical Function
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Cisco Policy Suite Diameter Routing Agent
Search vendor "Cisco" for product "Cisco Policy Suite Diameter Routing Agent"
--
Affected
Cisco
Search vendor "Cisco"
 Cisco Policy Suite For Mobile
Search vendor "Cisco" for product "Cisco Policy Suite For Mobile"
 13.0.0
Search vendor "Cisco" for product "Cisco Policy Suite For Mobile" and version "13.0.0"
-
Affected