Configuration error in Cisco Application Deployment Engine



Published: 2018-04-24
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2018-0275
CWE-ID CWE-16
Exploitation vector Local
Public exploit N/A
Vulnerable software
Subscribe 		Cisco Application Deployment Engine
Server applications / Frameworks for developing and running applications

Vendor Cisco Systems, Inc

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Configuration error

EUVDB-ID: #VU12069

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-0275

CWE-ID: CWE-16 - Configuration

Exploit availability: No

Description

The vulnerability allows a local authenticated attacker to execute arbitrary commands with elevated privileges on the target system.

The weakness exists in the support tunnel feature due to improper configuration. A local attacker can trick the device into unlocking the support user account and access the tunnel password and device serial number and run any system command with root privileges.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Cisco Application Deployment Engine: 0.3.0

CPE2.3 External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-ise


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###