CVE-2018-0147criticalunder attackCWE-20

CVE-2018-0147: critical vulnerability in Cisco Secure Access Control System

Published · Updated

Follow this CVE+ Monitor Secure Access Control System

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 18%
from disclosure to weapon
Published on NVDMar 8
CISA KEV+1478d
Action required by CISAfederal deadline: 2022-04-15

Apply updates per vendor instructions.

In short

Cisco Secure ACS before version 5.8 patch 9 has a critical flaw in how it processes Java data from the internet. An attacker can send specially crafted data to run any command on the system with full control, without needing a password.

Technical detail

Insecure Java deserialization in Cisco ACS allows unauthenticated remote code execution via crafted serialized objects. The vulnerability affects versions prior to 5.8 patch 9 and enables attackers to execute arbitrary commands with root privileges on the affected device.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a crafted serialized Java object. An exploit could allow the attacker to execute arbitrary commands on the device with root privileges. Cisco Bug IDs: CSCvh25988.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · Cisco Secure Access Control System