PT-2018-8627 · Cisco · Cisco Staros+1

Publicado 2018-02-08 · Atualizado 2020-09-04 · CVE-2018-0122

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Média

Vetor base

AV:L/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers (affected versions not specified)

Description: A vulnerability in the CLI of the Cisco StarOS operating system could allow an authenticated, local attacker to overwrite system files stored in the flash memory of an affected system. The issue is due to insufficient validation of user-supplied input by the affected operating system. An attacker could exploit this by injecting crafted command arguments into a vulnerable CLI command. A successful exploit could allow the attacker to overwrite or modify arbitrary files stored in the flash memory. The attacker would need to authenticate to an affected system using valid administrator credentials.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

RCE

Enumeração de Fraquezas

CWE-78

CWE-20

Identificadores relacionados

CVE-2018-0122

Produtos afetados

Cisco Asr 5000 Series

Cisco Staros

Referências · 5

• http://securitytracker.com/id/1040340 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-0122 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-asr · Aviso do Fabricante
• http://securityfocus.com/bid/103028 · Nota
• https://osv.dev/vulnerability/CVE-2018-0122 · Aviso do Fabricante