CVE-2018-15437
Cisco Immunet and Cisco AMP for Endpoints System Scan Denial of Service Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
A vulnerability in the system scanning component of Cisco Immunet and Cisco Advanced Malware Protection (AMP) for Endpoints running on Microsoft Windows could allow a local attacker to disable the scanning functionality of the product. This could allow executable files to be launched on the system without being analyzed for threats. The vulnerability is due to improper process resource handling. An attacker could exploit this vulnerability by gaining local access to a system running Microsoft Windows and protected by Cisco Immunet or Cisco AMP for Endpoints and executing a malicious file. A successful exploit could allow the attacker to prevent the scanning services from functioning properly and ultimately prevent the system from being protected from further intrusion.
Una vulnerabilidad en el componente de escaneo de sistemas Cisco Immunet y Cisco Advanced Malware Protection (AMP) for Endpoints que se ejecuten en Microsoft Windows podría permitir que un atacante local deshabilite la funcionalidad de escaneo del producto. Esto podría permitir que los archivos ejecutables se lancen en el sistema sin que se analicen en busca de amenazas. Esta vulnerabilidad se debe a la manipulación incorrecta de los recursos de los procesos. Un atacante podría explotar esta vulnerabilidad obteniendo acceso local a un sistema que se ejecute en Microsoft Windows y que esté protegido por Cisco Immunet o Cisco AMP for Endpoints y ejecutando un archivo malicioso. Su explotación con éxito podría permitir que el atacante evite que los servicios de escaneo funcionen correctamente y finalmente evitar que el sistema esté protegido contra futuras intrusiones.
A vulnerability in the system scanning component of Cisco Immunet and Cisco Advanced Malware Protection (AMP) for Endpoints running on Microsoft Windows could allow a local attacker to disable the scanning functionality of the product. This could allow executable files to be launched on the system without being analyzed for threats. The vulnerability is due to improper process resource handling. Cisco Immunet versions prior to 6.2.0 and Cisco AMP For Endpoints version 6.2.0 are affected.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2018-08-17 CVE Reserved
- 2018-11-08 CVE Published
- 2018-11-09 First Exploit
- 2024-11-26 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-400: Uncontrolled Resource Consumption
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/105867 | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://packetstorm.news/files/id/150241 | 2018-11-09 | |
| https://www.exploit-db.com/exploits/45829 | 2024-11-26 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-imm-dos | 2020-09-16 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Cisco Search vendor "Cisco" | Advanced Malware Protection For Endpoints Search vendor "Cisco" for product "Advanced Malware Protection For Endpoints" | - | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Immunet For Endpoints Search vendor "Cisco" for product "Immunet For Endpoints" | - | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|