CISA KEV · Known exploitedCritical

CVE-2018-0147

Cisco Secure Access Control System (ACS)

A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a crafted serialized Java object. An exploit could allow the attacker to execute arbitrary commands on the device with root privileges. Cisco Bug IDs: CSCvh25988.

CVSS: 9.8
EPSS: 18.3%
CISA KEV: Listed
Published: 2018.03.08

PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability18.3%

Technical severityCVSS 9.8

Vulnerability overview

Affected product and versions

Product: Cisco Secure Access Control System (ACS)
Affected versions: Cisco Secure Access Control System, 5.2(0.3)
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

CISA required action

Apply updates per vendor instructions.

Due date: 2022.04.15

1
Identify
Confirm that Cisco Secure Access Control System (ACS) and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-20, CWE-502
KEV added: 2022.03.25
Ransomware use: 미확인