PT-2018-8685 · Cisco · Cisco Staros

Published 2018-03-08 · Updated 2020-09-04 · CVE-2018-0224

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers (affected versions not specified)

Description: A vulnerability in the CLI of the Cisco StarOS operating system could allow an authenticated, local attacker to execute arbitrary commands with root privileges. The issue is due to insufficient validation of user-supplied input. An attacker could exploit this by authenticating to the system and injecting malicious arguments into a vulnerable CLI command, potentially allowing the execution of arbitrary commands with root privileges.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2018-0224

Affected Products

Cisco Staros

References · 5

• https://osv.dev/vulnerability/CVE-2018-0224 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-staros1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0224 · Security Note
• http://securityfocus.com/bid/103344 · Note
• http://securitytracker.com/id/1040466 · Note