Log in Start free

Actively exploited · Published Mar 8, 2018 · Assigned by cisco

CVE-2018-0147

Critical 9.8 Exploited

In plain English

A critical-severity improper input validation in Cisco Secure Access Control System. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2022). The chance it is exploited in the next 30 days is estimated at 18.2% (higher than 97% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)18.2%top 2.8% of all CVEs
Exploited in the wildYesCISA KEV since Mar 25, 2022
Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 15, 2022.

Official description

A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a crafted serialized Java object. An exploit could allow the attacker to execute arbitrary commands on the device with root privileges. Cisco Bug IDs: CSCvh25988.

Affected products (as reported)

VendorProductVersions
n/a Cisco Secure Access Control System Cisco Secure Access Control System

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References