CVE-2018-0113

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability in an operations script of Cisco UCS Central could allow an authenticated, remote attacker to execute arbitrary shell commands with the privileges of the daemon user. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by posting a crafted request to the user interface of Cisco UCS Central. This vulnerability affects Cisco UCS Central Software prior to Release 2.0(1c). Cisco Bug IDs: CSCve70825.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	Cisco UCS Central	Cisco UCS Central

References

http://www.securityfocus.com/bid/102966Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040337Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-ucscVendor Advisory
http://www.securityfocus.com/bid/102966Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040337Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-ucscVendor Advisory

Timeline

Published: Feb 8, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-01147.5A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens u CVE-2018-01156.7A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series routers could allow an authenticated, local attack CVE-2018-01167.2A vulnerability in the RADIUS authentication module of Cisco Policy Suite could allow an unauthenticated, remote attacker to be authorized a CVE-2018-01178.6A vulnerability in the ingress packet processing functionality of the Cisco Virtualized Packet Core-Distributed Instance (VPC-DI) Software c CVE-2018-01186.1A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacke CVE-2018-01194.7A vulnerability in certain authentication controls in the account services of Cisco Spark could allow an authenticated, remote attacker to i CVE-2018-01204.3A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct an SQL CVE-2018-01219.8A vulnerability in the authentication functionality of the web-based service portal of Cisco Elastic Services Controller Software could allo CVE-2018-01224.4A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authen CVE-2018-01235.5A Path Traversal vulnerability in the diagnostic shell for Cisco IOS and IOS XE Software could allow an authenticated, local attacker to use CVE-2018-01249.8A vulnerability in Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to bypass security protection CVE-2018-01259.8A vulnerability in the web interface of the Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers could allow an unaut