Cross-Site Request Forgery Vulnerability in Cisco Industrial Ethernet Switches
CVE-2018-0255

8.8HIGH

Key Information:

Vendor

Cisco
Status
Cisco Industrial Ethernet Switches
Vendor
CVE Published:
19 April 2018

What is CVE-2018-0255?

A vulnerability within the device manager web interface of Cisco Industrial Ethernet Switches allows an unauthenticated remote attacker to exploit insufficient CSRF protection. By manipulating users into clicking on malicious links or visiting compromised sites, attackers can submit arbitrary requests to affected devices with the user's privileges. This issue impacts various Cisco Industrial Ethernet Switches if they operate on vulnerable versions of Cisco IOS Software, posing a significant security risk.

Affected Version(s)

Cisco Industrial Ethernet Switches Cisco Industrial Ethernet Switches

References

http://www.securitytracker.com/id/1040715
vdb-entryx_refsource_SECTRACK
https://tools.cisco.com/security/center/content/CiscoSecu...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.