CVE-2018-0099
Quick assessment
Affected
n/a Cisco D9800 Network Transport Receiver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Cisco D9800 Network Transport Receiver是美国思科（Cisco）公司的一款提供了硬件配置和下载功能的网络传输接收机。Web management GUI是其中的一个Web管理界面。 Cisco D9800 Network Transport Receiver中的Web management GUI存在操作系统命令注入漏洞，该漏洞源于程序没有充分的验证GUI命令参数。远程攻击者可通过向受影响的GUI命令注入特制的参数利用该漏洞在底层的BusyBox操作系统上执行命令。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2018-0099
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in the web management GUI of the Cisco D9800 Network Transport Receiver could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of GUI command arguments. An attacker could exploit this vulnerability by injecting crafted arguments into a vulnerable GUI command. An exploit could allow the attacker to execute commands on the underlying BusyBox operating system. These commands are run at the privilege level of the authenticated user. The attacker needs valid device credentials for this attack. Cisco Bug IDs: CSCvg74691.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Cisco D9800 Network Transport Receiver Web management GUI 操作系统命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco D9800 Network Transport Receiver是美国思科（Cisco）公司的一款提供了硬件配置和下载功能的网络传输接收机。Web management GUI是其中的一个Web管理界面。 Cisco D9800 Network Transport Receiver中的Web management GUI存在操作系统命令注入漏洞，该漏洞源于程序没有充分的验证GUI命令参数。远程攻击者可通过向受影响的GUI命令注入特制的参数利用该漏洞在底层的BusyBox操作系统上执行命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | Cisco D9800 Network Transport Receiver | Cisco D9800 Network Transport Receiver | - |
|
II. Public POCs for CVE-2018-0099
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2018-0099
请登录查看更多情报信息。
Vendor Advisories for CVE-2018-0099 (1)
Same Patch Batch · n/a · 2018-01-18 · 44 CVEs total
| CVE-2018-5772 | Exiv2 安全漏洞 | |
| CVE-2016-6814 | Apache Groovy 代码问题漏洞 | |
| CVE-2017-15869 | LiveZilla 跨站脚本漏洞 | |
| CVE-2017-12729 | Moxa SoftCMS Live Viewer SQL注入漏洞 | |
| CVE-2017-17860 | Samsung Gear S2和S3 输入验证错误漏洞 | |
| CVE-2018-5776 | WordPress MediaElement 跨站脚本漏洞 | |
| CVE-2012-6708 | jQuery 跨站脚本漏洞 | |
| CVE-2015-9251 | jQuery 跨站脚本漏洞 | |
| CVE-2016-10707 | jQuery 安全漏洞 | |
| CVE-2018-5773 | markdown2 跨站脚本漏洞 | |
| CVE-2014-2017 | OXID eShop 安全漏洞 | |
| CVE-2018-5766 | Libav 安全漏洞 | |
| CVE-2018-0115 | Cisco ASR 5000 Series路由器Cisco StarOS操作系统命令注入漏洞 | |
| CVE-2018-0111 | Cisco WebEx Meetings Server 信息泄露漏洞 | |
| CVE-2018-0110 | Cisco WebEx Meetings Server 安全漏洞 | |
| CVE-2018-0109 | Cisco WebEx Meetings Server 信息泄露漏洞 | |
| CVE-2018-0108 | Cisco WebEx Meetings Server 信息泄露漏洞 | |
| CVE-2018-0107 | Cisco Prime Service Catalog 跨站脚本漏洞 | |
| CVE-2018-0106 | Cisco Elastic Services Controller 信息泄露漏洞 | |
| CVE-2018-0105 | Cisco Unified Communications Manager 信息泄露漏洞 |
Showing top 20 of 44 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2018-0099
No comments yet