#VU13221 Privilege escalation in Cisco Wide Area Application Services - CVE-2018-0352
Published: June 6, 2018 / Updated: June 7, 2018
Vulnerability identifier: #VU13221
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-0352
CWE-ID: CWE-119
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
Cisco Wide Area Application Services
Cisco Wide Area Application Services
Software vendor:
Cisco Systems, Inc
Cisco Systems, Inc
Description
The vulnerability allows a local high-privileged ttacker to gain elevated privileges the target system.
The vulnerability exists n the Disk Check Tool (disk-check.sh) for Cisco Wide Area Application Services (WAAS) Software due to insufficient validation of script files executed in the context of the Disk Check Tool. A local attacker with super user privileges (level 15) can replace one script file with a malicious script file while the affected tool is running, gain root-level privileges and take full control of the device.
Remediation
Update to versions 6.4(3.66), 6.4(1c)12, 6.4(1b)9, 6.2(3e)40.