CVE-2018-0113 Command injection in Cisco UCS Central

What is CVE-2018-0113?

CVE-2018-0113 is a high-severity command injection vulnerability in Cisco UCS Central, published on 8 Feb 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in an operations script of Cisco UCS Central could allow an authenticated, remote attacker to execute arbitrary shell commands with the privileges of the daemon user. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by posting a crafted request to the user interface of Cisco UCS Central. This vulnerability affects Cisco UCS Central Software prior to Release 2.0(1c). Cisco Bug IDs: CSCve70825.

Weakness: CWE-20

Which versions are affected by CVE-2018-0113?

It affects 1 product.

Products include Cisco Unified Computing System Central Software.

How do I fix CVE-2018-0113?

No fix has been published for CVE-2018-0113 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2018-0113 being exploited?

There is no known exploitation of CVE-2018-0113 in the wild and no public exploit code.

Other vulnerabilities in Cisco UCS Central

• CVE-2015-0701 Command injection in n/a Critical 10.0
• CVE-2016-1352 Command injection in n/a Critical 9.8
• CVE-2018-0094 Denial of service in Cisco UCS Central Software High 7.5
• CVE-2014-0730 Privilege escalation in n/a Medium 6.8
• CVE-2016-1401 Cross-site scripting in n/a Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4vp2-8c9h-5h96.