PT-2018-8627 · Cisco · Cisco Staros+1

Published 2018-02-08 · Updated 2020-09-04 · CVE-2018-0122

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers (affected versions not specified)

Description: A vulnerability in the CLI of the Cisco StarOS operating system could allow an authenticated, local attacker to overwrite system files stored in the flash memory of an affected system. The issue is due to insufficient validation of user-supplied input by the affected operating system. An attacker could exploit this by injecting crafted command arguments into a vulnerable CLI command. A successful exploit could allow the attacker to overwrite or modify arbitrary files stored in the flash memory. The attacker would need to authenticate to an affected system using valid administrator credentials.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

RCE

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

CVE-2018-0122

Affected Products

Cisco Asr 5000 Series

Cisco Staros

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-0122 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-asr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-0122 · Vendor Advisory
• http://securitytracker.com/id/1040340 · Note
• http://securityfocus.com/bid/103028 · Note