CVE-2018-0348

CWE-77 — Command InjectionCWE-78 — OS Command Injection4 documents4 sources
Severity
7.2HIGH
EPSS
0.3%
top 43.19%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Cisco Vedge-1000 FirmwareCisco Vedge-100 FirmwareCisco Vedge-2000 Firmware+4 more
Timeline
PublishedJul 18
Latest updateMay 13

Description

A vulnerability in the CLI of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting malicious input to the load command within the VPN subsystem. The attacker must be authenticated to access the affected CLI parameter. A successful exploit could allow an attacke…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages8 packages

🔴Vulnerability Details

2
GHSA
GHSA-cxf4-j4xp-frg7: A vulnerability in the CLI of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary commands that are executed w↗2022-05-13
▶
CVEList
CVE-2018-0348: A vulnerability in the CLI of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary commands that are executed w↗2018-07-18
▶

📋Vendor Advisories

1
Cisco
Cisco SD-WAN Solution CLI Command Injection Vulnerability↗2018-07-18
▶
CVE-2018-0348 (HIGH CVSS 7.2) | A vulnerability in the CLI of the C | cvebase.io