PT-2018-1611 · Cisco · Cisco Ios Xe

Published 2018-09-26 · Updated 2019-10-09 · CVE-2018-15372

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS XE (affected versions not specified)

Description The issue is related to a logic error in the MACsec Key Agreement (MKA) functionality of Cisco IOS XE Software, specifically when using Extensible Authentication Protocol-Transport Layer Security (EAP-TLS). This error could allow an unauthenticated, adjacent attacker to bypass authentication and pass traffic through a Layer 3 interface of an affected device. The attacker could exploit this by connecting to and passing traffic through a Layer 3 interface, if the interface is configured for MACsec MKA using EAP-TLS and is running in access-session closed mode. A successful exploit could allow the attacker to bypass 802.1x network access controls and gain access to the network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2018-01170

CVE-2018-15372

Affected Products

Cisco Ios Xe

References · 6

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-macsec · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15372 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15372 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01170 · Security Note
• https://securityfocus.com/bid/105416/info · Note
• http://securityfocus.com/bid/105416 · Note