Remote Code Execution Vulnerability in Cisco Elastic Services Controller Software

CVE-2018-0130

What is CVE-2018-0130?

A security flaw in Cisco Elastic Services Controller Software permits remote, unauthenticated attackers to bypass authentication and gain administrative access to the web-based service portal. This vulnerability arises from the use of static default credentials, which can be exploited if an attacker retrieves these credentials from an image of the affected software. Once obtained, the attacker can craft a valid session token to access other installations of the software, leading to potentially severe security breaches.

References