CVE-2018-0115: OS Command Injection
First published: Thu Jan 18 2018(Updated: )
A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series routers could allow an authenticated, local attacker to execute arbitrary commands with root privileges on an affected host operating system. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by injecting malicious command arguments into a vulnerable CLI command. A successful exploit could allow the attacker to execute arbitrary commands with root privileges. To exploit this vulnerability, the attacker would need to authenticate to the affected system by using valid administrator credentials. Cisco Bug IDs: CSCvf93332.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco StarOS | ||
| Cisco ASR 5000 | ||
| Cisco ASR 5500 | ||
| Cisco Asr 5700 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-0115?
CVE-2018-0115 is a vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series routers that could allow an authenticated, local attacker to execute arbitrary commands with root privileges on an affected host operating system.
How severe is CVE-2018-0115?
CVE-2018-0115 has a severity score of 6.7 (high).
Which software is affected by CVE-2018-0115?
The Cisco StarOS operating system for Cisco ASR 5000 Series routers is affected by CVE-2018-0115.
How can I fix CVE-2018-0115?
To fix CVE-2018-0115, apply the necessary security patches provided by Cisco.
Where can I find more information about CVE-2018-0115?
You can find more information about CVE-2018-0115 on the following websites: [SecurityFocus](http://www.securityfocus.com/bid/102788), [SecurityTracker](http://www.securitytracker.com/id/1040239), [Cisco Security Advisory](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-staros).
- collector/nvd-index
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/references
- agent/first-publish-date
- agent/author
- agent/type
- agent/tags
- agent/description
- agent/event
- vendor/cisco
- canonical/cisco staros
- canonical/cisco asr 5000
- canonical/cisco asr 5500
- canonical/cisco asr 5700