CVE-2018-0448
Cisco Digital Network Architecture Center Authentication Bypass Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A vulnerability in the identity management service of Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and take complete control of identity management functions. The vulnerability is due to insufficient security restrictions for critical management functions. An attacker could exploit this vulnerability by sending a valid identity management request to the affected system. An exploit could allow the attacker to view and make unauthorized modifications to existing system users as well as create new users.
Una vulnerabilidad en el servicio de gestión de identidades de Cisco Digital Network Architecture (DNA) Center podría permitir que un atacante remoto no autenticado omita la autenticación y tome el control total de las funciones de gestión de identidades. Esta vulnerabilidad se debe a restricciones de seguridad insuficientes para las funciones de gestión críticas. Un atacante podría explotar esta vulnerabilidad enviando una petición de gestión de identidades válida a un dispositivo afectado. Su explotación podría permitir que el atacante visualice y realice modificaciones no autorizadas a los usuarios del sistema existentes, así como crear nuevos usuarios.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-11-27 CVE Reserved
- 2018-10-05 CVE Published
- 2024-02-24 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-326: Inadequate Encryption Strength
CAPEC
References (2)
URL | Tag | Source |
---|---|---|
http://www.securityfocus.com/bid/105502 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Cisco Search vendor "Cisco" | Digital Network Architecture Center Search vendor "Cisco" for product "Digital Network Architecture Center" | < 1.1.4 Search vendor "Cisco" for product "Digital Network Architecture Center" and version " < 1.1.4" | - |
Affected
|