PT-2018-1030 · Cisco · Cisco Elastic Services Controller

Published 2018-02-21 · Updated 2019-10-09 · CVE-2018-0121

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Elastic Services Controller Software Release 3.0.0

Description A vulnerability in the authentication functionality of the web-based service portal could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrator privileges on an affected system. The issue is due to improper security restrictions imposed by the web-based service portal. An attacker could exploit this by submitting an empty password value when prompted to enter an administrative password, potentially gaining administrator privileges for the web-based service portal.

Recommendations For Cisco Elastic Services Controller Software Release 3.0.0, consider restricting access to the web-based service portal until a fix is available, and avoid using empty password values to prevent exploitation. As a temporary workaround, consider disabling the administrative password prompt for the portal until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2018-00325

CVE-2018-0121

Affected Products

Cisco Elastic Services Controller

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2018-0121 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-esc · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00325 · Security Note
• https://osv.dev/vulnerability/CVE-2018-0121 · Vendor Advisory
• https://securitylab.ru/news/491738.php · Note
• https://anti-malware.ru/news/2018-02-26-1447/25583 · Note
• http://securityfocus.com/bid/103113 · Note