CVE-2018-0121: Critical severity cisco elastic services controller major vulnerability
A vulnerability in the authentication functionality of the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrator privileges on an affected system. The vulnerability is due to improper security restrictions that are imposed by the web-based service portal of the affected software. An attacker could exploit this vulnerability by submitting an empty password value to an affected portal when prompted to enter an administrative password for the portal. A successful exploit could allow the attacker to bypass authentication and gain administrator privileges for the web-based service portal of the affected software. This vulnerability affects Cisco Elastic Services Controller Software Release 3.0.0. Cisco Bug IDs: CSCvg29809.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-0121?
CVE-2018-0121 is rated as high severity due to the potential for unauthenticated remote access and execution of arbitrary actions with administrator privileges.
How do I fix CVE-2018-0121?
The fix for CVE-2018-0121 involves applying the appropriate security patches provided by Cisco for the affected versions of Elastic Services Controller and Virtual Managed Services.
What systems are affected by CVE-2018-0121?
CVE-2018-0121 affects Cisco Elastic Services Controller version 3.0.0 and Cisco Virtual Managed Services version 3.0.
What potential exploits are possible with CVE-2018-0121?
An attacker exploiting CVE-2018-0121 can bypass authentication and execute any actions with administrative privileges on the affected systems.
Is CVE-2018-0121 previously known vulnerabilities?
Yes, CVE-2018-0121 was publicly disclosed and acknowledged in security advisories for Cisco products.