PT-2018-8845 · Cisco · Cisco Network Services Orchestrator

Publicado 2018-10-05 · Atualizado 2019-10-09 · CVE-2018-0463

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Network Services Orchestrator (NSO) (affected versions not specified)

Description A vulnerability exists in the Cisco Network Plug and Play server component due to incomplete validation when using secure unique device identifiers (SUDI) for authentication. This allows an unauthenticated, remote attacker to gain unauthorized access to configuration data stored on the system. The attacker must control a Cisco device that supports SUDI authentication, have connectivity to the affected system, and leverage information about devices being registered to send crafted authentication packets.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2018-0463

Produtos afetados

Cisco Network Services Orchestrator

Referências · 3

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-nso-infodis · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-0463 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-0463 · Nota de Segurança