CVE-2018-0116 — Improper Authentication in Cisco

Vendor	Product	Version range	Fixed in
cisco	mobility_services_engine	—	—
cisco	mobility_services_engine	—	—
cisco	mobility_services_engine	—	—
cisco	policy_suite_radius	—	—

Cisco

Cisco Policy Suite RADIUS Authentication Bypass Vulnerability

vendor_cisco·2018-02-07·CVSS 7.2

CVE-2018-0116 [HIGH] CWE-287 Cisco Policy Suite RADIUS Authentication Bypass Vulnerability Cisco Policy Suite RADIUS Authentication Bypass Vulnerability A vulnerability in the RADIUS authentication module of Cisco Policy Suite could allow an unauthenticated, remote attacker to be authorized as a subscriber without providing a valid password; however, the attacker must provide a valid username. The vulnerability is due to incorrect RADIUS user credential validation. An attacker could exploit this vulnerability by attempting to access a Cisco Policy Suite domain configured with RADIUS authentication. An exploit could allow the attacker to be authorized as a subscriber without providing a valid password. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:

Cisco

Cisco Policy Suite RADIUS Authentication Bypass Vulnerability

vendor_cisco·CVSS 3.0

CVE-2018-0116 Cisco Policy Suite RADIUS Authentication Bypass Vulnerability CVE-2018-0116: Cisco Policy Suite RADIUS Authentication Bypass Vulnerability A vulnerability in the RADIUS authentication module of Cisco Policy Suite could allow an unauthenticated, remote attacker to be authorized as a subscriber without providing a valid password; however, the attacker must provide a valid username. The vulnerability is due to incorrect RADIUS user credential validation. An attacker could exploit this vulnerability by attempting to access a Cisco Policy Suite domain configured with RADIUS authentication. An exploit could allow the attacker to be authorized as a subscriber without providing a valid password. Cisco has released software updates that address this vulnerability. There are no CVSS: 3.0 CWE: CWE-287, CWE-287 Bug IDs: CSCvg40124

GHSA

GHSA-7cfm-96c5-jhrr: A vulnerability in the RADIUS authentication module of Cisco Policy Suite could allow an unauthenticated, remote attacker to be authorized as a subscr

ghsa_unreviewed·2022-05-13

CVE-2018-0116 [HIGH] CWE-287 GHSA-7cfm-96c5-jhrr: A vulnerability in the RADIUS authentication module of Cisco Policy Suite could allow an unauthenticated, remote attacker to be authorized as a subscr A vulnerability in the RADIUS authentication module of Cisco Policy Suite could allow an unauthenticated, remote attacker to be authorized as a subscriber without providing a valid password; however, the attacker must provide a valid username. The vulnerability is due to incorrect RADIUS user credential validation. An attacker could exploit this vulnerability by attempting to access a Cisco Policy Suite domain configured with RADIUS authentication. An exploit could allow the attacker to be authorized as a subscriber without providing a valid password. This vulnerability affects the Cisco Policy Suite application running a release prior to 13.1.0 with Hotfix Patch 1 when RADIUS authentication is configured for a domain. Cisco Policy Suite Release 14.0.0 is also affected, as it includes vuln

CVE-2018-0116: A vulnerability in the RADIUS authentication module of Cisco Policy Suite could allow an unauthenticated, remote attacker to be authorized as a subscriber…

Affected

CVSS provenance