CVE-2018-0432

moderate-risk
Published 2018-10-05

A vulnerability in the error reporting feature of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to gain elevated privileges on an affected device. The vulnerability is due to a failure to properly validate certain parameters included within the error reporting application configuration. An attacker could exploit this vulnerability by sending a crafted command to the error reporting feature. A successful exploit could allow the attacker to gain root-level privileges and take full control of the device.

Do I need to act?

~
1.2% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (5)

Vedge 100 Firmware
Vedge 1000 Firmware
Vedge 2000 Firmware
Vedge 5000 Firmware
Vmanage Network Management System

Affected Vendors

46
/ 100
moderate-risk
Severity 30/34 · Critical
Exploitability 4/34 · Minimal
Exposure 12/34 · Low