PT-2018-8845 · Cisco · Cisco Network Services Orchestrator

Published 2018-10-05 · Updated 2019-10-09 · CVE-2018-0463

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Network Services Orchestrator (NSO) (affected versions not specified)

Description A vulnerability exists in the Cisco Network Plug and Play server component due to incomplete validation when using secure unique device identifiers (SUDI) for authentication. This allows an unauthenticated, remote attacker to gain unauthorized access to configuration data stored on the system. The attacker must control a Cisco device that supports SUDI authentication, have connectivity to the affected system, and leverage information about devices being registered to send crafted authentication packets.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2018-0463

Affected Products

Cisco Network Services Orchestrator

References · 3

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-nso-infodis · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-0463 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0463 · Security Note