Security restrictions bypass in Cisco FireSIGHT - CVE-2018-0333
Published: June 6, 2018 / Updated: June 7, 2018
Vulnerability identifier: #VU13224
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-0333
CWE-ID: CWE-693
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Cisco Systems, Inc
Affected software:
Cisco FireSIGHT
Cisco FireSIGHT
Detailed vulnerability description
The vulnerability allows a remote attacker to bypass security restrictions on the target system.
The vulnerability exists in the VPN configuration management of Cisco FireSIGHT System Software due to incorrect management of the configured interface names and VPN parameters when dynamic CLI configuration changes are performed. A remote unauthenticated attacker can send specially crafted packets through an interface and bypass configured VPN policies.
How to mitigate CVE-2018-0333
Update to version 6.2.3.