#VU12794 Improper authentication in Cisco Digital Network Architecture Center


Published: 2018-05-17

Vulnerability identifier: #VU12794

Vulnerability risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-0271

CWE-ID: CWE-287

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Cisco Digital Network Architecture Center
Web applications / Remote management & hosting panels

Vendor: Cisco Systems, Inc

Description
The vulnerability allows a remote attacker to gain elevated privileges on the target system.

The weakness exists in the API gateway due to a failure to normalize URLs prior to servicing requests. A remote attacker can submit a specially crafted URL and gain unauthenticated access to critical services, resulting in elevated privileges in DNA Center.

Mitigation
Update to version 1.1.2.

Vulnerable software versions

Cisco Digital Network Architecture Center: 1.1

External links
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-dna2

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Multiple critical vulnerabilities in Cisco Digital Network Architecture (DNA) Center