PT-2018-8718 · Cisco · Cisco Identity Services Engine

Published 2018-04-19 · Updated 2019-10-09 · CVE-2018-0275

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cisco Identity Services Engine (ISE) versions prior to 2.2.0.470

Description: A vulnerability in the support tunnel feature could allow an authenticated, local attacker to access the device's shell due to improper configuration. An attacker could exploit this by tricking the device into unlocking the support user account, accessing the tunnel password and device serial number, and then running any system command with root access.

Recommendations: For versions prior to 2.2.0.470, update to version 2.2.0.470 or later to resolve the issue. As a temporary workaround, consider restricting access to the support tunnel feature until a patch is applied.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2018-0275

Affected Products

Cisco Identity Services Engine

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-0275 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-ise · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-0275 · Vendor Advisory
• http://securitytracker.com/id/1040717 · Note