CVE-2018-0279 (CNNVD-201805-629)
中文标题:
Cisco Enterprise NFV Infrastructure Software Secure Copy Protocol服务器输入验证错误漏洞
英文标题:
A vulnerability in the Secure Copy Protocol (SCP) server of Cisco Enterprise NFV Infrastructure Soft...
漏洞描述
中文描述:
Cisco Enterprise NFV Infrastructure Software（NFVIS）是美国思科（Cisco）公司的一套NVF基础架构软件平台。该平台可以通过中央协调器和控制器实现虚拟化服务的全生命周期管理。Secure Copy Protocol（SCP）server是其中的一个文件复制服务器。 Cisco Enterprise NFVIS 3.7.1版本和3.6.3版本中的SCP服务器存在输入验证漏洞，该漏洞源于程序没有正确的对命令参数执行输入验证。远程攻击者可通过在打开与受影响设备的链接时使用特制的参数利用该漏洞访问底层Linux操作系统的shell。
英文描述:
A vulnerability in the Secure Copy Protocol (SCP) server of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to access the shell of the underlying Linux operating system on the affected device. The vulnerability is due to improper input validation of command arguments. An attacker could exploit this vulnerability by using crafted arguments when opening a connection to the affected device. An exploit could allow the attacker to gain shell access with a non-root user account to the underlying Linux operating system on the affected device. Due to the system design, access to the Linux shell could allow execution of additional attacks that may have a significant impact on the affected system. This vulnerability affects Cisco devices that are running release 3.7.1, 3.6.3, or earlier releases of Cisco Enterprise NFV Infrastructure Software (NFVIS) when access to the SCP server is allowed on the affected device. Cisco NFVIS Releases 3.5.x and 3.6.x do allow access to the SCP server by default, while Cisco NFVIS Release 3.7.1 does not. Cisco Bug IDs: CSCvh25026.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| cisco | enterprise_nfv_infrastructure_software | * | - | - |
cpe:2.3:a:cisco:enterprise_nfv_infrastructure_software:*:*:*:*:*:*:*:*
|
| cisco | enterprise_nfv_infrastructure_software | 3.7.1 | - | - |
cpe:2.3:a:cisco:enterprise_nfv_infrastructure_software:3.7.1:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2018-0279 |
2025-11-11 15:19:35 | 2025-11-11 07:34:56 |
| NVD | nvd_CVE-2018-0279 |
2025-11-11 14:55:54 | 2025-11-11 07:43:33 |
| CNNVD | cnnvd_CNNVD-201805-629 |
2025-11-11 15:10:01 | 2025-11-11 07:53:45 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 授权问题
- cnnvd_id: 未提取 -> CNNVD-201805-629
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- severity: SeverityLevel.MEDIUM -> SeverityLevel.HIGH
- cvss_score: 未提取 -> 8.8
- cvss_vector: NOT_EXTRACTED -> CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- cvss_version: NOT_EXTRACTED -> 3.1
- affected_products_count: 0 -> 2
- data_sources: ['cve'] -> ['cve', 'nvd']