SB2018051704 - Multiple critical vulnerabilities in Cisco Digital Network Architecture (DNA) Center

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018051704

SB2018051704 - Multiple critical vulnerabilities in Cisco Digital Network Architecture (DNA) Center

Published: May 17, 2018

Security Bulletin ID SB2018051704
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Privilege escalation (backdoor) (CVE-ID: CVE-2018-0222)

The vulnerability allows a remote attacker to log in to an affected system by using an administrative account that has default, static user credentials.

The weakness exist due to the presence of undocumented, static user credentials for the default administrative account. A remote attacker can use a backdoor account to log into the system and execute arbitrary commands with root privileges.


2) Privilege escalation (CVE-ID: CVE-2018-0268)

The vulnerability allows a remote attacker to bypass authentication and gain elevated privileges on the target system.

The weakness exist in the container management subsystem due to an insecure default configuration of the Kubernetes container management subsystem within DNA Center. A remote attacker can access the Kubernetes service port and execute arbitrary commands with elevated privileges within provisioned containers.

Successful exploitation of the vulnerability may result in system compromise.


3) Improper authentication (CVE-ID: CVE-2018-0271)

The vulnerability allows a remote attacker to gain elevated privileges on the target system.

The weakness exists in the API gateway due to a failure to normalize URLs prior to servicing requests. A remote attacker can submit a specially crafted URL and gain unauthenticated access to critical services, resulting in elevated privileges in DNA Center.

Remediation

Install update from vendor's website.

References