CVE-2018-15386
published 2018-10-05CVE-2018-15386: A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and have direct…
PriorityP267critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
3.44%
87.7th percentile
A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and have direct unauthorized access to critical management functions. The vulnerability is due to an insecure default configuration of the affected system. An attacker could exploit this vulnerability by directly connecting to the exposed services. An exploit could allow the attacker to retrieve and modify critical system files.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_digital_network_architecture_center | — | — |
| cisco | digital_network_architecture_center | — | — |
| cisco | digital_network_architecture_center | — | — |
| cisco | digital_network_architecture_center | — | — |
| cisco | digital_network_architecture_center | — | — |
| cisco | digital_network_architecture_center_unauthenticated_access | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit vector is direct unauthenticated connection to exposed management services on Cisco DNA Center — monitor for unexpected unauthenticated access attempts to DNA Center management interfaces ↗
- →Cisco internal bug IDs CSCvj05082 and CSCvj05086 track this vulnerability — use these identifiers when cross-referencing Cisco TAC or patch metadata ↗
- ·The vulnerability stems from an insecure default configuration of Cisco DNA Center — review and harden default service exposure settings as part of deployment ↗
- ·No workarounds exist; the only remediation is applying Cisco-released software updates ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_cisco9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9f8q-cq6p-jfgv: A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and have d
ghsa_unreviewed·2022-05-13
CVE-2018-15386 [CRITICAL] GHSA-9f8q-cq6p-jfgv: A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and have d
A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and have direct unauthorized access to critical management functions. The vulnerability is due to an insecure default configuration of the affected system. An attacker could exploit this vulnerability by directly connecting to the exposed services. An exploit could allow the attacker to retrieve and modify critical system files.
Cisco
Cisco Digital Network Architecture Center Unauthenticated Access Vulnerability
vendor_cisco·2018-10-03·CVSS 9.8
CVE-2018-15386 [CRITICAL] CWE-16 Cisco Digital Network Architecture Center Unauthenticated Access Vulnerability
Cisco Digital Network Architecture Center Unauthenticated Access Vulnerability
A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and have direct unauthorized access to critical management functions.
The vulnerability is due to an insecure default configuration of the affected system. An attacker could exploit this vulnerability by directly connecting to the exposed services. An exploit could allow the attacker to retrieve and modify critical system files.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurity
Cisco
Cisco Digital Network Architecture Center Unauthenticated Access Vulnerability
vendor_cisco·CVSS 3.0
CVE-2018-15386 Cisco Digital Network Architecture Center Unauthenticated Access Vulnerability
CVE-2018-15386: Cisco Digital Network Architecture Center Unauthenticated Access Vulnerability
A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and have direct unauthorized access to critical management functions. The vulnerability is due to an insecure default configuration of the affected system. An attacker could exploit this vulnerability by directly connecting to the exposed services. An exploit could allow the attacker to retrieve and modify critical system files. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.0
CWE: CWE-16, CWE-16
Bug IDs: CSCvj05082, CSCvj05086
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2018-10-05
Published