CVE-2018-0352

A vulnerability in the Disk Check Tool (disk-check.sh) for Cisco Wide Area Application Services (WAAS) Software could allow an authenticated, local attacker to elevate their privilege level to root. The attacker must have valid user credentials with super user privileges (level 15) to log in to the device. The vulnerability is due to insufficient validation of script files executed in the context of the Disk Check Tool. An attacker could exploit this vulnerability by replacing one script file with a malicious script file while the affected tool is running. A successful exploit could allow the attacker to gain root-level privileges and take full control of the device. Cisco Bug IDs: CSCvi72673.
Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:wide_area_application_services:6.2\(3\):*:*:*:*:*:*:*

History

21 Nov 2024, 03:38

Type Values Removed Values Added
References () http://www.securityfocus.com/bid/104464 - Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/104464 - Third Party Advisory, VDB Entry
References () http://www.securitytracker.com/id/1041077 - Third Party Advisory, VDB Entry () http://www.securitytracker.com/id/1041077 - Third Party Advisory, VDB Entry
References () https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-waas-priv-escalation - Vendor Advisory () https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-waas-priv-escalation - Vendor Advisory

Information

Published : 2018-06-07 21:29

Updated : 2024-11-21 03:38


NVD link : CVE-2018-0352

Mitre link : CVE-2018-0352

CVE.ORG link : CVE-2018-0352


JSON object : View

Products Affected

cisco

  • wide_area_application_services
CWE
CWE-264

Permissions, Privileges, and Access Controls

CWE-732

Incorrect Permission Assignment for Critical Resource