CVE-2018-0448: Cisco Digital Network Architecture Center Authentication Bypass Vulnerability
First published: Fri Oct 05 2018(Updated: )
A vulnerability in the identity management service of Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and take complete control of identity management functions. The vulnerability is due to insufficient security restrictions for critical management functions. An attacker could exploit this vulnerability by sending a valid identity management request to the affected system. An exploit could allow the attacker to view and make unauthorized modifications to existing system users as well as create new users.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco DNA Center | <1.1.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-0448?
CVE-2018-0448 is rated as critical due to its potential impact on identity management functions.
How do I fix CVE-2018-0448?
To mitigate CVE-2018-0448, upgrade Cisco Digital Network Architecture Center to version 1.1.5 or later.
Who is affected by CVE-2018-0448?
CVE-2018-0448 affects users of Cisco Digital Network Architecture Center versions prior to 1.1.5.
What could an attacker do with CVE-2018-0448?
An attacker exploiting CVE-2018-0448 could bypass authentication and gain complete control of identity management functions.
When was CVE-2018-0448 discovered?
CVE-2018-0448 was discovered and disclosed in October 2018.
- agent/references
- agent/type
- agent/softwarecombine
- agent/title
- agent/author
- agent/weakness
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco dna center