CVE-2018-0347

CWE-77 — Command Injection4 documents4 sources
Severity
7.8HIGH
EPSS
0.1%
top 66.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Cisco Vedge-1000 FirmwareCisco Vedge-100 FirmwareCisco Vedge-2000 Firmware+4 more
Timeline
PublishedJul 18
Latest updateMay 13

Description

A vulnerability in the Zero Touch Provisioning (ZTP) subsystem of the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting malicious input to the affected parameter. The attacker must be authenticated to access the affected parameter. A successful exploit could allo…

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages8 packages

🔴Vulnerability Details

2
GHSA
GHSA-qx27-h95h-m8mh: A vulnerability in the Zero Touch Provisioning (ZTP) subsystem of the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arb↗2022-05-13
▶
CVEList
CVE-2018-0347: A vulnerability in the Zero Touch Provisioning (ZTP) subsystem of the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arb↗2018-07-18
▶

📋Vendor Advisories

1
Cisco
Cisco SD-WAN Solution Zero Touch Provisioning Command Injection Vulnerability↗2018-07-18
▶
CVE-2018-0347 (HIGH CVSS 7.8) | A vulnerability in the Zero Touch P | cvebase.io