« Volver al listado

CVE-2018-0298

Estado: ModificadaAlta (7.5)—

A vulnerability in the web UI of Cisco FXOS and Cisco UCS Fabric Interconnect Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected system. The vulnerability is due to incorrect input validation in the web UI. An attacker could exploit this vulnerability by sending a malicious HTTP or HTTPS packet directed to the physical management interface of an affected system. A successful exploit could allow the attacker to cause the process to crash and possibly reload the device, resulting in a denial of service (DoS) condition on the affected system.

Leer descripción completaMostrar menos

This vulnerability affects Firepower 4100 Series Next-Generation Firewall, Firepower 9300 Security Appliance, UCS 6200 Series Fabric Interconnects, UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvb61398, CSCvb86799.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Cisco — Firepower Extensible Operating SystemCisco — Nx-os

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-0298",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2018-0298",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-29T14:43:41.574159Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Cisco FXOS Software and UCS Fabric Interconnect unknown",
          "versions": [
            {
              "status": "affected",
              "version": "Cisco FXOS Software and UCS Fabric Interconnect unknown"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-06-21T11:29:00.240",
  "references": [
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-fxos-dos",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-fxos-dos",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@cisco.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the web UI of Cisco FXOS and Cisco UCS Fabric Interconnect Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected system. The vulnerability is due to incorrect input validation in the web UI. An attacker could exploit this vulnerability by sending a malicious HTTP or HTTPS packet directed to the physical management interface of an affected system. A successful exploit could allow the attacker to cause the process to crash and possibly reload the device, resulting in a denial of service (DoS) condition on the affected system. This vulnerability affects Firepower 4100 Series Next-Generation Firewall, Firepower 9300 Security Appliance, UCS 6200 Series Fabric Interconnects, UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvb61398, CSCvb86799."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la interfaz web de Cisco FXOS y Cisco UCS Fabric Interconnect Software podría permitir que un atacante remoto sin autenticar provoque un desbordamiento de búfer en un sistema afectado. Esta vulnerabilidad se debe a la incompleta validación de entradas en la interfaz web. Un atacante podría explotar esta vulnerabilidad enviando un paquete HTTP o HTTPS directamente a la interfaz de gestión física de un sistema afectado. Su explotación con éxito podría permitir que el atacante haga que el proceso se cierre inesperadamente y, posiblemente, que se reinicie el dispositivo, provocando una denegación de servicio (DoS) en el sistema afectado. esta vulnerabilidad afecta a Firepower 4100 Series Next-Generation Firewall, Firepower 9300 Security Appliance, UCS 6200 Series Fabric Interconnects y UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvb61398, CSCvb86799."
    }
  ],
  "lastModified": "2026-06-17T01:30:25.800",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "96B9E0CF-5926-4DDB-9298-BADDD33B66D0",
              "versionEndExcluding": "3.1\\(3a\\)a",
              "versionStartIncluding": "3.0\\(2\\)"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:ucs_6120xp:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "FC6E3DFD-A811-4FD3-B888-ABCDEFCD3A4B"
            },
            {
              "criteria": "cpe:2.3:h:cisco:ucs_6140xp:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "C0246716-64E9-4CCA-9546-A3A40D375E95"
            },
            {
              "criteria": "cpe:2.3:h:cisco:ucs_6248up:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "49112D3F-DFAD-4E71-992B-9E0640FA388C"
            },
            {
              "criteria": "cpe:2.3:h:cisco:ucs_6296up:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "38A1D8F2-A4A6-4BAC-8326-9F9DE9572FA2"
            },
            {
              "criteria": "cpe:2.3:h:cisco:ucs_6324:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B82093C6-B36D-4E4E-AD7F-8C107646B8D9"
            },
            {
              "criteria": "cpe:2.3:h:cisco:ucs_6332:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E406DDCE-6753-43E9-B6F0-7A038DE84E41"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:firepower_extensible_operating_system:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63CFEFD0-F2F2-4220-903C-A11446902C4D",
              "versionEndExcluding": "1.1.4.169",
              "versionStartIncluding": "1.1"
            },
            {
              "criteria": "cpe:2.3:o:cisco:firepower_extensible_operating_system:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2695D838-79D5-4C2F-8B41-0900AABAAE48",
              "versionEndExcluding": "2.0.1.135",
              "versionStartIncluding": "2.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:firepower_4110:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A0CBC7F5-7767-43B6-9384-BE143FCDBD7F"
            },
            {
              "criteria": "cpe:2.3:h:cisco:firepower_4120:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "38AE6DC0-2B03-4D36-9856-42530312CC46"
            },
            {
              "criteria": "cpe:2.3:h:cisco:firepower_4140:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "3DB2822B-B752-4CD9-A178-934957E306B4"
            },
            {
              "criteria": "cpe:2.3:h:cisco:firepower_4150:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "65378F3A-777C-4AE2-87FB-1E7402F9EA1B"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:firepower_extensible_operating_system:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5581E60-8144-4630-9545-8DC0B7AD44A1",
              "versionEndExcluding": "1.1.4.179",
              "versionStartIncluding": "1.1"
            },
            {
              "criteria": "cpe:2.3:o:cisco:firepower_extensible_operating_system:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABA77B46-C30C-4427-9401-6500B6221ACE",
              "versionEndExcluding": "2.0.1.153",
              "versionStartIncluding": "2.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:firepower_9300_security_appliance:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "0574E77C-18C6-4621-B73A-DCDD6D1B5E37"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}