Improper input validation in Enterprise NFV Infrastructure Software - CVE-2018-0462
Published: September 6, 2018
Vulnerability identifier: #VU14668
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-0462
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote administrative attacker to cause DoS condition.
The vulnerability exists in the user management functionality of Cisco Enterprise NFV Infrastructure Software (NFVIS) due to insufficient validation of user-provided input. A remote attacker can log in with a highly privileged user account, perform a sequence of specific user management operations that interfere with the underlying operating system and permanently degrade the functionality of the affected system.
Affected software
Enterprise NFV Infrastructure Software
How to mitigate CVE-2018-0462
Install update from vendor's website.