OS Command Injection in Cisco HyperFlex - CVE-2018-15380
Published: February 22, 2019
Vulnerability identifier: #VU17834
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-15380
CWE-ID: CWE-78
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an adjacent attacker to execute arbitrary shell commands on the target system.
The vulnerability exists in the cluster service manager due to insufficient input validation. An adjacent unauthenticated attacker can connect to the cluster service manager and inject commands into the bound process to run commands on the affected host as the root user..
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Cisco HyperFlex
How to mitigate CVE-2018-15380
Update to version 3.5(2a).
Cisco HyperFlex - update to 3.5.2a