CVE-2018-0141

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

A vulnerability in Cisco Prime Collaboration Provisioning (PCP) Software 11.6 could allow an unauthenticated, local attacker to log in to the underlying Linux operating system. The vulnerability is due to a hard-coded account password on the system. An attacker could exploit this vulnerability by connecting to the affected system via Secure Shell (SSH) using the hard-coded credentials. A successful exploit could allow the attacker to access the underlying operating system as a low-privileged user. After low-level privileges are gained, the attacker could elevate to root privileges and take full control of the device. Cisco Bug IDs: CSCvc82982.

Metrics

CVSS 3.0 8.4/10CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
n/a	Cisco Prime Collaboration Provisioning	Cisco Prime Collaboration Provisioning

References

http://www.securityfocus.com/bid/103329Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040462Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-cpcpVendor Advisory
http://www.securityfocus.com/bid/103329Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040462Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-cpcpVendor Advisory

Timeline

Published: Mar 8, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-01446.1A vulnerability in the web-based management interface of Cisco Prime Data Center Network Manager could allow an unauthenticated, remote atta CVE-2018-01456.1A vulnerability in the web-based management interface of the Cisco Data Center Analytics Framework application could allow an unauthenticate CVE-2018-01465.4A vulnerability in the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a cross-CVE-2018-01479.8A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthe CVE-2018-01488.8A vulnerability in the web-based management interface of Cisco UCS Director Software and Cisco Integrated Management Controller (IMC) Superv CVE-2018-01494.8A vulnerability in the web-based management interface of Cisco Integrated Management Controller Supervisor Software and Cisco UCS Director S CVE-2018-01509.8A vulnerability in Cisco IOS XE Software could allow an unauthenticated, remote attacker to log in to a device running an affected release o CVE-2018-01519.8A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, re CVE-2018-01528.8A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to gain elev CVE-2018-01547.5A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an una CVE-2018-01558.6A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Cata CVE-2018-01567.5A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker