AEGLIX vulnerability intelligence
CVE-2018-0147
CRITICAL · CVSS 9.8 · Analyzed
Published: 2018-03-08 · Updated: 2026-06-17 · Source: NVD
Vulnerability overview
A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a crafted serialized Java object. An exploit could allow the attacker to execute arbitrary commands on the device with root privileges. Cisco Bug IDs: CSCvh25988.
Severity and scoring
- CVSS score
- 9.8 · CRITICAL
- CVSS version
- 3.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-20, CWE-502
CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.
Known exploitation and remediation
Listed in CISA’s Known Exploited Vulnerabilities catalog.
- Affected product
- Cisco · Secure Access Control System (ACS)
- Added to catalog
- 2022-03-25
- Required action
- Apply updates per vendor instructions.
- CISA remediation due date
- 2022-04-15
CISA deadlines apply to the organizations covered by its directives. Confirm your own remediation requirements.
Verify affected versions and patch availability in the vendor advisory before making changes.
Affected products and versions
cpe:2.3:a:cisco:secure_access_control_system:5.2\(0.3\):*:*:*:*:*:*:*
These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.
Advisories and references
- http://www.securityfocus.com/bid/103328
Broken Link · Third Party Advisory · VDB Entry
- http://www.securitytracker.com/id/1040463
Third Party Advisory · VDB Entry
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-acs2
Vendor Advisory
- http://www.securityfocus.com/bid/103328
Broken Link · Third Party Advisory · VDB Entry
- http://www.securitytracker.com/id/1040463
Third Party Advisory · VDB Entry
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-acs2
Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0147
US Government Resource