CVE-2018-0427

High

Description

A vulnerability in the CronJob scheduler API of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability is due to incorrect input validation of user-supplied data. An attacker could exploit this vulnerability by sending a malicious packet. A successful exploit could allow the attacker to execute arbitrary commands with root privileges. Cisco Bug IDs: CSCvi42263.

SeverityHigh

CVSS8.8

Exploit probability—

Product

Cisco Application Policy Infrastructure Controller Enterprise Module

PublishedAug 15, 2018

First seenAug 15, 2018

Weakness typeCWE-77Command injection

How to fix

Vendor advisories

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180815-dna-injection

Affected products

Product	Affected versions	Fixed in
cisco application_policy_infrastructure_controller_enterprise_module	dnac1.1	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.