CVE-2018-0427: OS Command Injection

Published Aug 15, 2018

Updated

A vulnerability in the CronJob scheduler API of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability is due to incorrect input validation of user-supplied data. An attacker could exploit this vulnerability by sending a malicious packet. A successful exploit could allow the attacker to execute arbitrary commands with root privileges. Cisco Bug IDs: CSCvi42263.

Affected Software

1 affected component

Cisco Application Policy Infrastructure Controller Enterprise Module=dnac1.1

Event History

Aug 15, 2018

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-0427?

CVE-2018-0427 is classified as a high-severity vulnerability.

How do I fix CVE-2018-0427?

To fix CVE-2018-0427, upgrade to the version of Cisco Application Policy Infrastructure Controller that addresses this vulnerability.

Can CVE-2018-0427 be exploited remotely?

Yes, CVE-2018-0427 can be exploited by an authenticated, remote attacker.

What causes CVE-2018-0427?

CVE-2018-0427 is caused by incorrect input validation of user-supplied data in the CronJob scheduler API.

Who is affected by CVE-2018-0427?

CVE-2018-0427 affects users of Cisco Digital Network Architecture (DNA) Center running version dnac1.1.