PT-2018-8629 · Cisco · Cisco Unified Communications Domain Manager

Published 2018-02-22 · Updated 2019-10-09 · CVE-2018-0124

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Cisco Unified Communications Domain Manager versions prior to 11.5(2)

Description: A vulnerability could allow an unauthenticated, remote attacker to bypass security protections, gain elevated privileges, and execute arbitrary code. The issue is due to insecure key generation during application configuration. An attacker could exploit this by using a known insecure key value to bypass security protections and send arbitrary requests to a targeted application, potentially allowing the execution of arbitrary code.

Recommendations: For versions prior to 11.5(2), update to version 11.5(2) or later to resolve the issue. As a temporary workaround, consider restricting access to the application configuration to minimize the risk of exploitation. Avoid using known insecure key values in the application configuration until the issue is resolved.

Fix

Weakness Enumeration

CWE-320

Related Identifiers

CVE-2018-0124

Affected Products

Cisco Unified Communications Domain Manager

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-0124 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-ucdm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-0124 · Vendor Advisory
• http://securitytracker.com/id/1040405 · Note
• http://securityfocus.com/bid/103114 · Note