« Volver al listado

CVE-2018-0373

Estado: ModificadaMedia (5.5)—

A vulnerability in vpnva-6.sys for 32-bit Windows and vpnva64-6.sys for 64-bit Windows of Cisco AnyConnect Secure Mobility Client for Windows Desktop could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system. The vulnerability is due to improper validation of user-supplied data. An attacker could exploit this vulnerability by sending a malicious request to the application. A successful exploit could allow the attacker to cause a DoS condition on the affected system. Cisco Bug IDs: CSCvj47654.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cisco — Anyconnect Secure Mobility Client

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-0373",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2018-0373",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-29T14:37:30.489814Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.9,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Cisco AnyConnect Secure Mobility Client unknown",
          "versions": [
            {
              "status": "affected",
              "version": "Cisco AnyConnect Secure Mobility Client unknown"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-06-21T11:29:01.227",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/104548",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1041176",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-anyconnect-dos",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/104548",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1041176",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-anyconnect-dos",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@cisco.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in vpnva-6.sys for 32-bit Windows and vpnva64-6.sys for 64-bit Windows of Cisco AnyConnect Secure Mobility Client for Windows Desktop could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system. The vulnerability is due to improper validation of user-supplied data. An attacker could exploit this vulnerability by sending a malicious request to the application. A successful exploit could allow the attacker to cause a DoS condition on the affected system. Cisco Bug IDs: CSCvj47654."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en vpnva-6.sys para Windows de 32 bits y vpnva64-6.sys para Windows de 64 bits enCisco AnyConnect Secure Mobility Client para Windows Desktop podría permitir que un atacante local autenticado provoque una denegación de servicio (DoS) en un sistema afectado. Esta vulnerabilidad se debe a una validación incorrecta de los datos proporcionados por el usuario. Un atacante podría explotar esta vulnerabilidad mediante el envío de una petición maliciosa a la aplicación. Su explotación con éxito podría permitir que un atacante provoque una denegación de servicio (DoS) en el sistema afectado. Cisco Bug IDs: CSCvj47654."
    }
  ],
  "lastModified": "2026-06-17T01:30:37.080",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.5\\(58\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9B0A0171-260B-4E2D-8D7F-035345D9C902"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.5\\(1044\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "468C81E8-D599-47AE-870E-641CEEC0BF7B"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.5\\(2033\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "426675B2-921D-4C1C-ACAA-AC1B8439CA66"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.5\\(2036\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3B256AAA-0DFB-41A4-BC98-2DB809C08A33"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.5\\(3040\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "788EC44C-08A7-42EA-B657-ED0E02D4EBE6"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.5\\(4029\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8DAD5740-B44F-498A-B997-8C0482BCDD8B"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.5\\(5030\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "023FB667-653F-4634-9C65-4D076AD16F51"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.6\\(362\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "72519817-7E9A-433D-B03D-32C8382E2DB4"
            },
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.6\\(1098\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE6AC94E-E971-4E42-B410-68CD49B39AB9"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}