Security restrictions bypass in Cisco FireSIGHT - CVE-2018-0333
Published: June 6, 2018 / Updated: June 7, 2018
Vulnerability identifier: #VU13224
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-0333
CWE-ID: CWE-693
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass security restrictions on the target system.
The vulnerability exists in the VPN configuration management of Cisco FireSIGHT System Software due to incorrect management of the configured interface names and VPN parameters when dynamic CLI configuration changes are performed. A remote unauthenticated attacker can send specially crafted packets through an interface and bypass configured VPN policies.
Affected software
Cisco FireSIGHT
How to mitigate CVE-2018-0333
Update to version 6.2.3.
Cisco FireSIGHT - update to 6.2.3