CVE-2018-0300 (CNNVD-201806-1128)
中文标题:
Cisco Firepower 4100 Series Next-Generation Firewall和Firepower 9300 Security Appliance 路径遍历漏洞
英文标题:
A vulnerability in the process of uploading new application images to Cisco FXOS on the Cisco Firepo...
漏洞描述
中文描述:
Cisco Firepower 4100 Series Next-Generation Firewall（NGFW）和Firepower 9300 Security Appliance都是美国思科（Cisco）公司的产品。Cisco Firepower 4100 Series Next-Generation Firewall（NGFW）是一款4100系列的防火墙产品。Firepower 9300 Security Appliance是一款9300系列的安全设备。FXOS是一套运行在思科安全设备中的防火墙软件。 Cisco Firepower 4100 Series NGFW和Firepower 9300 Security Appliance中的新应用程序镜像上传的处理存在路径遍历漏洞，该漏洞源于在应用程序镜像上传进程中，程序没有执行充分的验证。远程攻击者可通过创建带有恶意代码的应用程序镜像并在使用CLI和Web UI的受影响设备上安装该镜像利用该漏洞创建或覆盖受影响设备的上的任意文件。
英文描述:
A vulnerability in the process of uploading new application images to Cisco FXOS on the Cisco Firepower 4100 Series Next-Generation Firewall (NGFW) and Firepower 9300 Security Appliance could allow an authenticated, remote attacker using path traversal techniques to create or overwrite arbitrary files on an affected device. The vulnerability is due to insufficient validation during the application image upload process. An attacker could exploit this vulnerability by creating an application image containing malicious code and installing the image on the affected device using the CLI or web-based user interface (web UI). These actions occur prior to signature verification and could allow the attacker to create and execute arbitrary code with root privileges. Note: A missing or invalid signature in the application image will cause the upload process to fail, but does not prevent the exploit. Cisco Bug IDs: CSCvc21901.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| cisco | fxos | 2.0\(1.68\) | - | - |
cpe:2.3:o:cisco:fxos:2.0\(1.68\):*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2018-0300 |
2025-11-11 15:19:35 | 2025-11-11 07:34:57 |
| NVD | nvd_CVE-2018-0300 |
2025-11-11 14:55:55 | 2025-11-11 07:43:33 |
| CNNVD | cnnvd_CNNVD-201806-1128 |
2025-11-11 15:10:02 | 2025-11-11 07:53:46 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 路径遍历
- cnnvd_id: 未提取 -> CNNVD-201806-1128
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- severity: SeverityLevel.MEDIUM -> SeverityLevel.HIGH
- cvss_score: 未提取 -> 7.2
- cvss_vector: NOT_EXTRACTED -> CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- cvss_version: NOT_EXTRACTED -> 3.0
- affected_products_count: 0 -> 1
- data_sources: ['cve'] -> ['cve', 'nvd']