CVE-2018-0258

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability in the Cisco Prime File Upload servlet affecting multiple Cisco products could allow a remote attacker to upload arbitrary files to any directory of a vulnerable device (aka Path Traversal) and execute those files. This vulnerability affects the following products: Cisco Prime Data Center Network Manager (DCNM) Version 10.0 and later, and Cisco Prime Infrastructure (PI) All versions. Cisco Bug IDs: CSCvf32411, CSCvf81727.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22CWE-434

Affected software

VendorProductVersions
n/aCisco Prime File Upload ServletCisco Prime File Upload Servlet

References

Timeline

Published
May 2, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-02598.8A vulnerability in the web-based management interface of Cisco MATE Collector could allow an unauthenticated, remote attacker to conduct a cCVE-2018-02605.3A vulnerability in the web interface of Cisco MATE Live could allow an unauthenticated, remote attacker to view and download the contents ofCVE-2018-02628.1A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to gain unauthorized access to components of, or senCVE-2018-02637.4A vulnerability in Cisco Meeting Server (CMS) could allow an unauthenticated, adjacent attacker to access services running on internal devicCVE-2018-02649.6A vulnerability in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow an unauthenticated, remoteCVE-2018-02664.3A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view sensitiveCVE-2018-02676.5A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, local attacker to view sensitive CVE-2018-026810.0A vulnerability in the container management subsystem of Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remCVE-2018-02694.3A vulnerability in the web framework of the Cisco Digital Network Architecture Center (DNA Center) could allow an unauthenticated, remote atCVE-2018-02708.8A vulnerability in the web-based management interface of Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote aCVE-2018-02719.8A vulnerability in the API gateway of the Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker toCVE-2018-02725.9A vulnerability in the Secure Sockets Layer (SSL) Engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker
CVE-2018-0258: Critical severity, CVSS 9.8 | Vulnix