CVE-2018-0352
published 2018-06-07CVE-2018-0352: A vulnerability in the Disk Check Tool (disk-check.sh) for Cisco Wide Area Application Services (WAAS) Software could allow an authenticated, local attacker to…
PriorityP429medium6.7CVSS 3.0
AVLACLPRHUINSUCHIHAH
EPSS
0.39%
31.3th percentile
A vulnerability in the Disk Check Tool (disk-check.sh) for Cisco Wide Area Application Services (WAAS) Software could allow an authenticated, local attacker to elevate their privilege level to root. The attacker must have valid user credentials with super user privileges (level 15) to log in to the device. The vulnerability is due to insufficient validation of script files executed in the context of the Disk Check Tool. An attacker could exploit this vulnerability by replacing one script file with a malicious script file while the affected tool is running. A successful exploit could allow the attacker to gain root-level privileges and take full control of the device. Cisco Bug IDs: CSCvi72673.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | wide_area_application_services | — | — |
| cisco | wide_area_application_services | — | — |
CVSS provenance
nvdv3.06.7MEDIUMCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vendor_cisco6.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Wide Area Application Services Software Scripts Privilege Escalation Vulnerability
vendor_cisco·2018-06-06·CVSS 6.7
CVE-2018-0352 [MEDIUM] CWE-264 Cisco Wide Area Application Services Software Scripts Privilege Escalation Vulnerability
Cisco Wide Area Application Services Software Scripts Privilege Escalation Vulnerability
A vulnerability in Cisco-provided scripts (disk-check.sh and harcap.sh) for Cisco Wide Area Application Services (WAAS) Software could allow an authenticated, local attacker to elevate their privilege level to root. The attacker must have valid user credentials with super user privileges (level 15) to log in to the device.
The vulnerability is due to insufficient validation of script files executed in the context of the Cisco-provided scripts. An attacker could exploit this vulnerability by replacing one script file with a malicious script file while an affected Cisco-provided script is running. A successful exploit could allow the attacker to gain root-level privileges and take full control of the de
Cisco
Cisco Wide Area Application Services Software Scripts Privilege Escalation Vulnerability
vendor_cisco·CVSS 3.0
CVE-2018-0352 Cisco Wide Area Application Services Software Scripts Privilege Escalation Vulnerability
CVE-2018-0352: Cisco Wide Area Application Services Software Scripts Privilege Escalation Vulnerability
A vulnerability in Cisco-provided scripts ( disk-check.sh and harcap.sh ) for Cisco Wide Area Application Services (WAAS) Software could allow an authenticated, local attacker to elevate their privilege level to root . The attacker must have valid user credentials with super user privileges (level 15) to log in to the device. The vulnerability is due to insufficient validation of script files executed in the context of the Cisco-provided scripts. An attacker could exploit this vulnerability by replacing one script file with a malicious script file while an affected Cisco-provided script is running. A successful exploit could allow the attacker to gain root -level privileges and take full
GHSA
GHSA-wqg8-f34c-vm4v: A vulnerability in the Disk Check Tool (disk-check
ghsa_unreviewed·2022-05-13
CVE-2018-0352 [HIGH] CWE-732 GHSA-wqg8-f34c-vm4v: A vulnerability in the Disk Check Tool (disk-check
A vulnerability in the Disk Check Tool (disk-check.sh) for Cisco Wide Area Application Services (WAAS) Software could allow an authenticated, local attacker to elevate their privilege level to root. The attacker must have valid user credentials with super user privileges (level 15) to log in to the device. The vulnerability is due to insufficient validation of script files executed in the context of the Disk Check Tool. An attacker could exploit this vulnerability by replacing one script file with a malicious script file while the affected tool is running. A successful exploit could allow the attacker to gain root-level privileges and take full control of the device. Cisco Bug IDs: CSCvi72673.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/104464http://www.securitytracker.com/id/1041077https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-waas-priv-escalationhttp://www.securityfocus.com/bid/104464http://www.securitytracker.com/id/1041077https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-waas-priv-escalation
2018-06-07
Published