« Volver al listado

CVE-2018-15425

Estado: ModificadaMedia (4.7)—

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device with the privileges of the web server.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cisco — Identity Services Engine

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-15425",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2018-15425",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-25T18:47:49.860011Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.7,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "Cisco",
          "product": "Cisco Identity Services Engine Software",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-10-05T14:29:11.187",
  "references": [
    {
      "url": "http://www.securitytracker.com/id/1041792",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-ise-mult-vulns",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1041792",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-ise-mult-vulns",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@cisco.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device with the privileges of the web server."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la interfaz de gestión web de Cisco Identity Services Engine (ISE) podría permitir que un atacante remoto autenticado ejecute comandos arbitrarios en el sistema operativo subyacente de un dispositivo afectado con los privilegios del servidor web."
    }
  ],
  "lastModified": "2026-06-17T01:42:27.740",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.1\\(0.474\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F8E53B93-2A49-4B3F-8487-E45D8F70F64C"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.1\\(0.907\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BAB5312C-C251-4D82-AFA4-4FFCD9BBA0E6"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.2\\(0.470\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF54E8D0-76EE-40DE-A971-000C0B66A373"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.2\\(0.909\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "32411DF9-0B83-45A0-8546-5EB64B762B82"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.3\\(0.298\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "422288B0-9F85-4420-8E5E-83378E099853"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.3\\(0.905\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C7FFDEB-EEC6-4EA8-9F22-5F33EE280AD2"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.4\\(0.357\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B60E8BB7-EAC5-4120-AFD0-5E72CCC97670"
            },
            {
              "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.4\\(0.904\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF352E12-B209-4206-921F-B6F1B403F117"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}