CVE-2018-0141
published 2018-03-08CVE-2018-0141: A vulnerability in Cisco Prime Collaboration Provisioning (PCP) Software 11.6 could allow an unauthenticated, local attacker to log in to the underlying Linux…
PriorityP344high8.4CVSS 3.0
AVLACLPRNUINSUCHIHAH
EPSS
0.43%
35.0th percentile
A vulnerability in Cisco Prime Collaboration Provisioning (PCP) Software 11.6 could allow an unauthenticated, local attacker to log in to the underlying Linux operating system. The vulnerability is due to a hard-coded account password on the system. An attacker could exploit this vulnerability by connecting to the affected system via Secure Shell (SSH) using the hard-coded credentials. A successful exploit could allow the attacker to access the underlying operating system as a low-privileged user. After low-level privileges are gained, the attacker could elevate to root privileges and take full control of the device. Cisco Bug IDs: CSCvc82982.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | prime_collaboration | — | — |
| cisco | prime_collaboration_assurance | — | — |
| cisco | prime_collaboration_provisioning | — | — |
| cisco | prime_collaboration_provisioning_hard-coded_password | — | — |
CVSS provenance
nvdv3.08.4HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vendor_cisco5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Prime Collaboration Provisioning Hard-Coded Password Vulnerability
vendor_cisco·2018-03-08·CVSS 5.9
CVE-2018-0141 [MEDIUM] CWE-798 Cisco Prime Collaboration Provisioning Hard-Coded Password Vulnerability
Cisco Prime Collaboration Provisioning Hard-Coded Password Vulnerability
A vulnerability in Cisco Prime Collaboration Provisioning (PCP) Software could allow an unauthenticated, local attacker to log in to the underlying Linux operating system.
The vulnerability is due to a hard-coded account password on the system. An attacker could exploit this vulnerability by connecting to the affected system via Secure Shell (SSH) using the hard-coded credentials. A successful exploit could allow the attacker to access the underlying operating system as a low-privileged user. After low-level privileges are gained, the attacker could elevate to root privileges and take full control of the device.
Note: Although this vulnerability has a Common Vulnerability Scoring System (CVSS) Base score of 5.9, wh
Cisco
Cisco Prime Collaboration Provisioning Hard-Coded Password Vulnerability
vendor_cisco·CVSS 3.0
CVE-2018-0141 Cisco Prime Collaboration Provisioning Hard-Coded Password Vulnerability
CVE-2018-0141: Cisco Prime Collaboration Provisioning Hard-Coded Password Vulnerability
A vulnerability in Cisco Prime Collaboration Provisioning (PCP) Software could allow an unauthenticated, local attacker to log in to the underlying Linux operating system. The vulnerability is due to a hard-coded account password on the system. An attacker could exploit this vulnerability by connecting to the affected system via Secure Shell (SSH) using the hard-coded credentials. A successful exploit could allow the attacker to access the underlying operating system as a low-privileged user. After low-level privileges are gained, the attacker could elevate to root privileges and take full control of the device. Note: Although this vulnerability has a Common Vulnerability Scoring System (CVSS) Base scor
GHSA
GHSA-mx4m-2wwh-7g8m: A vulnerability in Cisco Prime Collaboration Provisioning (PCP) Software 11
ghsa_unreviewed·2022-05-13
CVE-2018-0141 [HIGH] CWE-798 GHSA-mx4m-2wwh-7g8m: A vulnerability in Cisco Prime Collaboration Provisioning (PCP) Software 11
A vulnerability in Cisco Prime Collaboration Provisioning (PCP) Software 11.6 could allow an unauthenticated, local attacker to log in to the underlying Linux operating system. The vulnerability is due to a hard-coded account password on the system. An attacker could exploit this vulnerability by connecting to the affected system via Secure Shell (SSH) using the hard-coded credentials. A successful exploit could allow the attacker to access the underlying operating system as a low-privileged user. After low-level privileges are gained, the attacker could elevate to root privileges and take full control of the device. Cisco Bug IDs: CSCvc82982.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/103329http://www.securitytracker.com/id/1040462https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-cpcphttp://www.securityfocus.com/bid/103329http://www.securitytracker.com/id/1040462https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-cpcp
2018-03-08
Published