CVE-2018-0324CWE-77

A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, high-privileged, local attacker to perform a…

published May 17, 2018

CVSS
—
EPSS
1%
Percentile
50.9
In the wild
Unconfirmed
What it is

A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, high-privileged, local attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of command parameters in the CLI parser. An attacker could exploit this vulnerability by invoking a vulnerable CLI command with crafted malicious parameters. An exploit could allow the attacker to execute arbitrary commands with a non-root user account on the underlying Linux operating system of the affected device. Cisco Bug IDs: CSCvi09723.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00660 · 50.9th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2018-05-17T03:00Z
EPSS history
Timeline
  • 17 MAY 03:00Z
    A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, high-privileged, local attacker to perform a…
    cvelistv5