CVE-2018-0138CWE-693

CVE-2018-0138

Medium · published February 8, 2018

CVSS v3.0
5.3
EPSS
1%
Percentile
67.2
In the wild
Unconfirmed
What it is

A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass file policies that are configured to block files transmitted to an affected device via the BitTorrent protocol. The vulnerability exists because the affected software does not detect BitTorrent handshake messages correctly. An attacker could exploit this vulnerability by sending a crafted BitTorrent connection request to an affected device. A successful exploit could allow the attacker to bypass file policies that are configured to block files transmitted to the affected device via the BitTorrent protocol. Cisco Bug IDs: CSCve26946.

The record
Technical detail
CVSS v3.0
5.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01173 · 67.2th percentile
Weakness
CWE-693 · Protection Mechanism Failure
Published
2018-02-08T12:29Z
Affected products (4)
ProductVersionsFixed in
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
cisco/secure_firewall_threat_defenseall versions—
References (4)
http://www.securityfocus.com/bid/102978 · [email protected]https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-fss · [email protected]http://www.securityfocus.com/bid/102978 · af854a3a-2127-422b-91ae-364da2661108https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-fss · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 08 FEB 07:00Z
    A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass file policies that are…
    cvelistv5