High severity · published Oct 5, 2018
CVE-2018-0432
A vulnerability in the error reporting feature of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to gain elevated privileges on an affected device
8.8
CVSS
2.6%
EPSS
No
On KEV
Description
A vulnerability in the error reporting feature of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to gain elevated privileges on an affected device. The vulnerability is due to a failure to properly validate certain parameters included within the error reporting application configuration. An attacker could exploit this vulnerability by sending a crafted command to the error reporting feature. A successful exploit could allow the attacker to gain root-level privileges and take full control of the device.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
V1
Vedge 100 Firmware · Cisco
before 18.3.0 · source: NVD
V1
Vedge 1000 Firmware · Cisco
before 18.3.0 · source: NVD
V2
Vedge 2000 Firmware · Cisco
before 18.3.0 · source: NVD
V5
Vedge 5000 Firmware · Cisco
before 18.3.0 · source: NVD
VN
Vmanage Network Management System · Cisco
All versions, or not specified · source: NVD
Affected product
V1
Vedge 100 Firmware
Cisco
More from Vedge 100 Firmware
9.8
CVE-2018-0349
A vulnerability in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to overwrite arbitrary files on the underlying operating system of an affected device
8.8
CVE-2019-1650
Cisco SD-WAN Solution Arbitrary File Overwrite Vulnerability
8.8
CVE-2018-0350
A vulnerability in the VPN subsystem configuration in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary commands that are executed with…
8.8
CVE-2018-0345
A vulnerability in the configuration and management database of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to execute arbitrary commands with the…
8.8
CVE-2018-0343
A vulnerability in the configuration and management service of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to execute arbitrary code with vmanage user…