CVE-2018-0377: cisco mobility_services_engine

Vulnerability summary

CVE-2018-0377 is a critical (CVSS 9.8) vulnerability in cisco mobility_services_engine. EPSS estimates a 2.62% chance of exploitation in the next 30 days, higher than 85.2% of scored vulnerabilities.

Timeline

1. 18-07-2018
   PublishedVulnerability first disclosed.
2. 29-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the Open Systems Gateway initiative (OSGi) interface of Cisco Policy Suite before 18.1.0 could allow an unauthenticated, remote attacker to directly connect to the OSGi interface. The vulnerability is due to a lack of authentication. An attacker could exploit this vulnerability by directly connecting to the OSGi interface. An exploit could allow the attacker to access or change any files that are accessible by the OSGi process. Cisco Bug IDs: CSCvh18017.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.