CVE-2018-0352
First published: Thu Jun 07 2018(Updated: )
A vulnerability in the Disk Check Tool (disk-check.sh) for Cisco Wide Area Application Services (WAAS) Software could allow an authenticated, local attacker to elevate their privilege level to root. The attacker must have valid user credentials with super user privileges (level 15) to log in to the device. The vulnerability is due to insufficient validation of script files executed in the context of the Disk Check Tool. An attacker could exploit this vulnerability by replacing one script file with a malicious script file while the affected tool is running. A successful exploit could allow the attacker to gain root-level privileges and take full control of the device. Cisco Bug IDs: CSCvi72673.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Wide Area Application Services | =6.2\(3\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-0352?
CVE-2018-0352 is classified as a high severity vulnerability that allows privilege escalation.
How do I fix CVE-2018-0352?
To mitigate CVE-2018-0352, update the Cisco Wide Area Application Services software to a version that contains the security fix.
Who is affected by CVE-2018-0352?
CVE-2018-0352 affects users of Cisco Wide Area Application Services version 6.2(3) with authenticated access.
What type of attacker can exploit CVE-2018-0352?
An authenticated, local attacker with super user privileges can exploit CVE-2018-0352 to gain root access.
What does CVE-2018-0352 allow an attacker to do?
CVE-2018-0352 allows an attacker to elevate their privilege level to root on the affected Cisco WAAS system.
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- agent/author
- agent/references
- agent/severity
- agent/description
- agent/tags
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- vendor/cisco
- canonical/cisco wide area application services
- version/cisco wide area application services/6.2\(3\)