CVE-2018-0253
published 2018-05-02CVE-2018-0253: A vulnerability in the ACS Report component of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary…
PriorityP269critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
6.98%
93.4th percentile
A vulnerability in the ACS Report component of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected system. Commands executed by the attacker are processed at the targeted user's privilege level. The vulnerability is due to insufficient validation of the Action Message Format (AMF) protocol. An attacker could exploit this vulnerability by sending a crafted AMF message that contains malicious code to a targeted user. A successful exploit could allow the attacker to execute arbitrary commands on the ACS device. This vulnerability affects all releases of Cisco Secure ACS prior to Release 5.8 Patch 7. Cisco Bug IDs: CSCve69037.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | secure | — | — |
| cisco | secure_access_control_system | < 5.8 | 5.8 |
| cisco | secure_access_control_system | — | — |
| cisco | secure_access_control_system | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit vector is a crafted AMF (Action Message Format) protocol message sent to the ACS Report component; detect malformed/malicious AMF traffic targeting Cisco ACS web interface ↗
- →Attack is unauthenticated and targets the ACS Report component via the web interface; monitor for unexpected unauthenticated access to the Cisco ACS web interface ↗
- →If Active Directory is integrated with Cisco ACS, monitor for domain administrator credential theft following exploitation ↗
- ·All releases of Cisco Secure ACS prior to Release 5.8 Patch 7 are vulnerable; patch to 5.8 Patch 7 or later to remediate ↗
- ·There are no workarounds available for this vulnerability; software update is the only mitigation ↗
- ·Cisco Bug ID CSCve69037 tracks this vulnerability and can be used for vendor patch tracking ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_cisco9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Secure Access Control System Remote Code Execution Vulnerability
vendor_cisco·2018-05-02·CVSS 9.8
CVE-2018-0253 [CRITICAL] CWE-20 Cisco Secure Access Control System Remote Code Execution Vulnerability
Cisco Secure Access Control System Remote Code Execution Vulnerability
A vulnerability in the ACS Report component of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected system. Commands executed by the attacker are processed at the targeted user's privilege level.
The vulnerability is due to insufficient validation of the Action Message Format (AMF) protocol. An attacker could exploit this vulnerability by sending a crafted AMF message that contains malicious code to a targeted user. A successful exploit could allow the attacker to execute arbitrary commands on the ACS device.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This
Cisco
Cisco Secure Access Control System Remote Code Execution Vulnerability
vendor_cisco·CVSS 3.0
CVE-2018-0253 Cisco Secure Access Control System Remote Code Execution Vulnerability
CVE-2018-0253: Cisco Secure Access Control System Remote Code Execution Vulnerability
A vulnerability in the ACS Report component of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected system. Commands executed by the attacker are processed at the targeted user's privilege level. The vulnerability is due to insufficient validation of the Action Message Format (AMF) protocol. An attacker could exploit this vulnerability by sending a crafted AMF message that contains malicious code to a targeted user. A successful exploit could allow the attacker to execute arbitrary commands on the ACS device. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.0
CWE: CWE-20, CWE-20
Bug ID
GHSA
GHSA-99xc-j93w-f7qr: A vulnerability in the ACS Report component of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arb
ghsa_unreviewed·2022-05-13
CVE-2018-0253 [CRITICAL] CWE-20 GHSA-99xc-j93w-f7qr: A vulnerability in the ACS Report component of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arb
A vulnerability in the ACS Report component of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected system. Commands executed by the attacker are processed at the targeted user's privilege level. The vulnerability is due to insufficient validation of the Action Message Format (AMF) protocol. An attacker could exploit this vulnerability by sending a crafted AMF message that contains malicious code to a targeted user. A successful exploit could allow the attacker to execute arbitrary commands on the ACS device. This vulnerability affects all releases of Cisco Secure ACS prior to Release 5.8 Patch 7. Cisco Bug IDs: CSCve69037.
No detection rules found.
No public exploits indexed.
Tenable
Critical Cisco Secure Access Control System (ACS) Vulnerability
blogs_tenable·2018-06-08·CVSS 9.8
CVE-2018-0253 [CRITICAL] Critical Cisco Secure Access Control System (ACS) Vulnerability
Blog / Cyber Exposure Alerts
Subscribe
# Critical Cisco Secure Access Control System (ACS) Vulnerability
Steve Tilson
June 8, 2018
1 Min Read
Researchers at Positive Technologies discovered a serious flaw (CVE-2018-0253) in Cisco’s Secure Access Control System (ACS). System administrators use Cisco ACS to authenticate users across the network. The vulnerability allows external access to the Cisco ACS web interface, thereby allowing attackers to possibly gain unrestricted access to the internal network.
### Analysis
An attacker who successfully exploits the ACS Report component of Cisco ACS could execute arbitrary commands on the affected system, which would be processed at the targeted user's privilege level.
The Cisco vulnerability received a CVSS v3.0 score of 9.8 out of 10, indi
Tenable
Critical Cisco Secure Access Control System (ACS) Vulnerability
blogs_tenable·2018-06-08
Critical Cisco Secure Access Control System (ACS) Vulnerability
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
http://www.securityfocus.com/bid/104075http://www.securitytracker.com/id/1040808https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-acs1http://www.securityfocus.com/bid/104075http://www.securitytracker.com/id/1040808https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-acs1
2018-05-02
Published