CVE-2018-0446: Cisco Industrial Network Director Cross-Site Request Forgery Vulnerability

Published Oct 5, 2018

Updated

A vulnerability in the web-based management interface of Cisco Industrial Network Director could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious, customized link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device via a web browser and with the privileges of the user.

Affected Software

1 affected component

Cisco Network Level Service=1.5\(0.128\)

Event History

Oct 5, 2018

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2018-0446?

CVE-2018-0446 is a vulnerability in the web-based management interface of Cisco Industrial Network Director.

How severe is CVE-2018-0446?

CVE-2018-0446 has a severity rating of 8.8 (high).

What is the affected software for CVE-2018-0446?

The affected software for CVE-2018-0446 is Cisco Network Level Service version 1.5 (0.128).

What is the vulnerability description of CVE-2018-0446?

CVE-2018-0446 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device.

How can I fix CVE-2018-0446?

To fix CVE-2018-0446, Cisco recommends upgrading to a fixed software release.