CVE-2018-0350

CWE-77 — Command Injection4 documents4 sources
Severity
8.8HIGH
EPSS
0.5%
top 35.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Cisco Vedge-1000 FirmwareCisco Vedge-100 FirmwareCisco Vedge-2000 Firmware+4 more
Timeline
PublishedJul 18
Latest updateMay 13

Description

A vulnerability in the VPN subsystem configuration in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the affected parameter in a web page. The attacker must be authenticated to access the affected parameter. A successful exploit could all…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages8 packages

🔴Vulnerability Details

2
GHSA
GHSA-2hp5-x58m-vhpj: A vulnerability in the VPN subsystem configuration in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary comm↗2022-05-13
▶
CVEList
CVE-2018-0350: A vulnerability in the VPN subsystem configuration in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary comm↗2018-07-18
▶

📋Vendor Advisories

1
Cisco
Cisco SD-WAN Solution VPN Subsystem Command Injection Vulnerability↗2018-07-18
▶
CVE-2018-0350 (HIGH CVSS 8.8) | A vulnerability in the VPN subsyste | cvebase.io