SB2018020807 - Command execution in Cisco UCS Central Software
Published: February 8, 2018
Security Bulletin ID
SB2018020807
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) OS command injection (CVE-ID: CVE-2018-0113)
The vulnerability allows a remote authenticated attacker to execute arbitrary shell commands on the target system.
The vulnerability exists in an operations script of Cisco UCS Central due to insufficient input validation. A remote attacker can post a specially crafted request to the user interface of Cisco UCS Central, inject and execute arbitrary shell commands with the privileges of the daemon user.
Successful exploitation of the vulnerability may result in system compromise.
Remediation
Install update from vendor's website.