Improper input validation in Cisco Unified Computing System unknown
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863.
Summary
A vulnerability in the role-based access-checking mechanisms of Cisco Unified Computing System (UCS) Software could allow an authenticated, local attacker to execute arbitrary commands on an affected system. The vulnerability exists because the affected software lacks proper input and validation checks for certain file systems. An attacker could exploit this vulnerability by issuing crafted commands in the CLI of an affected system. A successful exploit could allow the attacker to cause other users to execute unwanted arbitrary commands on the affected system. Cisco Bug IDs: CSCvf52994.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Cisco Unified Computing System unknown | Cisco Unified Computing System unknown | — | No fix listed | CNA |
- Cisco Unified Computing System unknown Vendor— Affected Cisco Unified Computing System unknown Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:unified_computing_system:5.5\(203\):*:*:*:*:*:*:* | 5.5(203) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:unified_computing_system:7.0\(0\)bz\(0.46\):*:*:*:*:*:*:* | 7.0(0)bz(0.46) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:unified_computing_system:9.0\(100.20\)b:*:*:*:*:*:*:* | 9.0(100.20)b | Vulnerable | Cisco |
| cpe:2.3:a:cisco:unified_computing_system:9.1\(1.13\):*:*:*:*:*:*:* | 9.1(1.13) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:unified_computing_system:9.9\(0.902\):*:*:*:*:*:*:* | 9.9(0.902) | Vulnerable | Cisco |
- cpe:2.3:a:cisco:unified_computing_system:5.5\(203\):*:*:*:*:*:*:* Versions 5.5(203) Vulnerable ·Cisco
- cpe:2.3:a:cisco:unified_computing_system:7.0\(0\)bz\(0.46\):*:*:*:*:*:*:* Versions 7.0(0)bz(0.46) Vulnerable ·Cisco
- cpe:2.3:a:cisco:unified_computing_system:9.0\(100.20\)b:*:*:*:*:*:*:* Versions 9.0(100.20)b Vulnerable ·Cisco
- cpe:2.3:a:cisco:unified_computing_system:9.1\(1.13\):*:*:*:*:*:*:* Versions 9.1(1.13) Vulnerable ·Cisco
- cpe:2.3:a:cisco:unified_computing_system:9.9\(0.902\):*:*:*:*:*:*:* Versions 9.9(0.902) Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-0338
- 2026-10-03 Alias added: GHSA-9xpm-3gq8-r4x6
References
More Cisco Unified Computing System vulnerabilities
- TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
- TI-2015-05417 An unspecified CGI script in Cisco FX-OS before 1.1.2 on Firepower 9000 devices and Cisco… CVSS 3.0CRITICAL 9.8
- TI-2020-08191 IP-in-IP protocol allows a remote, unauthenticated attacker to route arbitrary network traffic CVSS 3.1MEDIUM 5.3
- TI-2018-00390 Cisco Integrated Management Controller Command Injection Vulnerability CVSS 3.0HIGH 8.8
- TI-2018-00389 Cisco Integrated Management Controller Command Injection Vulnerability CVSS 3.0HIGH 8.8
- TI-2021-01114 Cisco NX-OS Software IPv6 Netstack Denial of Service Vulnerability CVSS 3.1HIGH 8.6
Sources
- CVE-2018-0338 · CVE Program
- CVE-2018-0338 · NVD
- FIRST EPSS
- GHSA-9xpm-3gq8-r4x6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences