Configuration error in Cisco Application Deployment Engine - CVE-2018-0275
Published: April 20, 2018
Vulnerability identifier: #VU12069
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-0275
CWE-ID: CWE-16
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local authenticated attacker to execute arbitrary commands with elevated privileges on the target system.
The weakness exists in the support tunnel feature due to improper configuration. A local attacker can trick the device into unlocking the support user account and access the tunnel password and device serial number and run any system command with root privileges.
Affected software
Cisco Application Deployment Engine
How to mitigate CVE-2018-0275
Install update from vendor's website.