Command execution in Cisco Secure Access Control Server Solution Engine

1) Command injection

EUVDB-ID: #VU12391

Risk: Low

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-0253

CWE-ID: CWE-77 - Command injection

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on the target system.

The weakness exists in the ACS Report component due to insufficient validation of the Action Message Format (AMF) protocol. A remote attacker can send a specially crafted AMF message that contains malicious code, inject and execute arbitrary commands with root privileges.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Cisco Secure Access Control Server: 5.8.0.8

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-acs1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.