High severity · published Feb 20, 2019
CVE-2018-15380
Cisco HyperFlex Software Command Injection Vulnerability
8.8
CVSS
1.1%
EPSS
No
On KEV
Description
A vulnerability in the cluster service manager of Cisco HyperFlex Software could allow an unauthenticated, adjacent attacker to execute commands as the root user. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by connecting to the cluster service manager and injecting commands into the bound process. A successful exploit could allow the attacker to run commands on the affected host as the root user. This vulnerability affects Cisco HyperFlex Software releases prior to 3.5(2a).
CVSS vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Cisco HyperFlex HX-Series · Cisco
before 3.5(2a) · source: vendor
HH
Hyperflex HX Data Platform · Cisco
3.0(1a); 3.5(1a) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-15380
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-15380
Third Party Advisory
http://www.securityfocus.com/bid/107095
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-hyperflex-injection
More from Cisco HyperFlex HX-Series
7.8
CVE-2019-1664
Cisco HyperFlex Software Unauthenticated Root Access Vulnerability
6.1
CVE-2019-1665
Cisco Hyperflex Stored Cross-Site Scripting Vulnerability
5.3
CVE-2019-1666
Cisco HyperFlex Unauthenticated Statistics Retrieval Vulnerability
3.3
CVE-2019-1667
Cisco HyperFlex Arbitrary Statistics Write Vulnerability