CVE-2018-0298 Memory corruption in Cisco FXOS Software and UCS Fabric Interconnect unknown
Unauthenticated remote attackers can cause a buffer overflow in the web UI, leading to a denial of service on Cisco FXOS and UCS devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-0298?
CVE-2018-0298 is a high-severity memory corruption vulnerability in Cisco Firepower Extensible Operating System, published on 21 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the web UI of Cisco FXOS and Cisco UCS Fabric Interconnect Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected system. The vulnerability is due to incorrect input validation in the web UI. An attacker could exploit this vulnerability by sending a malicious HTTP or HTTPS packet directed to the physical management interface of an affected system. A successful exploit could allow the attacker to cause the process to crash and possibly reload the device, resulting in a denial of service (DoS) condition on the affected system. This vulnerability affects Firepower 4100 Series Next-Generation Firewall, Firepower 9300 Security Appliance, UCS 6200 Series Fabric Interconnects, UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvb61398, CSCvb86799.
Which versions are affected by CVE-2018-0298?
It affects 2 products.
Products include Cisco Firepower Extensible Operating System, Cisco Nx-Os.
How do I fix CVE-2018-0298?
No fix has been published for CVE-2018-0298 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2018-0298 being exploited?
There is no known exploitation of CVE-2018-0298 in the wild and no public exploit code.
Other vulnerabilities in Cisco Firepower Extensible Operating System
- CVE-2018-0310 Information disclosure in Cisco FXOS and NX-OS unknown
- CVE-2015-6435 Command injection in n/a
- CVE-2021-1368 Memory corruption in Cisco NX-OS Software
- CVE-2020-3456 Cisco FXOS Software Firepower Chassis Manager Cross-Site Request Forgery Vulnerability
- CVE-2020-3172 Cisco FXOS and NX-OS Software Cisco Discovery Protocol Arbitrary Code Execution and Denial of Service Vulnerability
All Cisco Firepower Extensible Operating System vulnerabilities
Sources
Also known as GHSA-ggmw-9f62-8x2v.