Command Injection Vulnerability in Cisco Network Services Orchestrator
CVE-2018-0274

8.8HIGH

Key Information:

Vendor

Cisco
Status
Cisco Network Services Orchestrator Unknown
Vendor
CVE Published:
7 June 2018

What is CVE-2018-0274?

A security flaw in the CLI parser of Cisco Network Services Orchestrator allows authenticated remote attackers to execute arbitrary shell commands as the root user. This vulnerability, caused by insufficient input validation, enables attackers to inject malicious arguments into vulnerable commands. Successful exploitation can lead to full control over the affected system, posing significant risks to the network's integrity and security. Affected versions are 4.1 through 4.1.6.0, 4.2 through 4.2.4.0, 4.3 through 4.3.3.0, and 4.4 through 4.4.2.0.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Cisco Network Services Orchestrator unknown Cisco Network Services Orchestrator unknown

References

http://www.securityfocus.com/bid/104449
vdb-entryx_refsource_BID
https://tools.cisco.com/security/center/content/CiscoSecu...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.