PT-2018-8685 · Cisco · Cisco Staros

Publicado 2018-03-08 · Atualizado 2020-09-04 · CVE-2018-0224

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers (affected versions not specified)

Description: A vulnerability in the CLI of the Cisco StarOS operating system could allow an authenticated, local attacker to execute arbitrary commands with root privileges. The issue is due to insufficient validation of user-supplied input. An attacker could exploit this by authenticating to the system and injecting malicious arguments into a vulnerable CLI command, potentially allowing the execution of arbitrary commands with root privileges.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Command Injection

Enumeração de Fraquezas

CWE-78

CWE-77

Identificadores relacionados

CVE-2018-0224

Produtos afetados

Cisco Staros

Referências · 5

• https://osv.dev/vulnerability/CVE-2018-0224 · Aviso do Fabricante
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-staros1 · Aviso do Fabricante
• http://securityfocus.com/bid/103344 · Nota
• http://securitytracker.com/id/1040466 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-0224 · Nota de Segurança