CVE-2018-0254

MediumCVSS 5.3/10Last modified Aug 11, 2026

Description

A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass configured file action policies if an Intelligent Application Bypass (IAB) with a drop percentage threshold is also configured. The vulnerability is due to incorrect counting of the percentage of dropped traffic. An attacker could exploit this vulnerability by sending network traffic to a targeted device. An exploit could allow the attacker to bypass configured file action policies, and traffic that should be dropped could be allowed into the network. Cisco Bug IDs: CSCvf86435.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-693

Affected software

No affected versions have been published.

Timeline

Published
Apr 19, 2018
Last modified
Aug 11, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-02558.8A vulnerability in the device manager web interface of Cisco Industrial Ethernet Switches could allow an unauthenticated, remote attacker toCVE-2018-02565.8A vulnerability in the peer-to-peer message processing functionality of Cisco Packet Data Network Gateway could allow an unauthenticated, reCVE-2018-02574.3A vulnerability in Cisco IOS XE Software running on Cisco cBR Series Converged Broadband Routers could allow an unauthenticated, adjacent atCVE-2018-02589.8A vulnerability in the Cisco Prime File Upload servlet affecting multiple Cisco products could allow a remote attacker to upload arbitrary fCVE-2018-02598.8A vulnerability in the web-based management interface of Cisco MATE Collector could allow an unauthenticated, remote attacker to conduct a cCVE-2018-02605.3A vulnerability in the web interface of Cisco MATE Live could allow an unauthenticated, remote attacker to view and download the contents ofCVE-2018-02628.1A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to gain unauthorized access to components of, or senCVE-2018-02637.4A vulnerability in Cisco Meeting Server (CMS) could allow an unauthenticated, adjacent attacker to access services running on internal devicCVE-2018-02649.6A vulnerability in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow an unauthenticated, remoteCVE-2018-02664.3A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view sensitiveCVE-2018-02676.5A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, local attacker to view sensitive CVE-2018-026810.0A vulnerability in the container management subsystem of Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, rem
CVE-2018-0254: Medium severity, CVSS 5.3 | Vulnix