PT-2018-8737 · Cisco · Cisco Fxos+2

Published 2018-06-21 · Updated 2019-10-09 · CVE-2018-0300

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cisco Firepower 4100 Series Next-Generation Firewall (NGFW) and Firepower 9300 Security Appliance (affected versions not specified)

Description: A vulnerability in the Cisco FXOS application image upload process could allow an authenticated, remote attacker to create or overwrite arbitrary files on an affected device using path traversal techniques. The issue is due to insufficient validation during the upload process. An attacker could exploit this by creating an application image with malicious code and installing it on the device, potentially allowing the execution of arbitrary code with root privileges. This exploit occurs before signature verification, and a missing or invalid signature in the image will cause the upload to fail but does not prevent the exploit.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-0300

Affected Products

Cisco Fxos

Cisco Firepower 4100 Series Next-Generation Firewall

Cisco Firepower 9300 Security Appliance

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-firepwr-pt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0300 · Security Note
• https://osv.dev/vulnerability/CVE-2018-0300 · Vendor Advisory
• http://securitytracker.com/id/1041169 · Note