Vulnerability in Cisco Policy Suite
CVE-2018-0089
A vulnerability in the Policy and Charging Rules Function (PCRF) of the Cisco Policy Suite (CPS) could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The attacker would also have to have access to the internal VLAN where CPS is deployed. The vulnerability is due to incorrect permissions of certain system files and not sufficiently protecting sensitive data that is at rest. An attacker could exploit the vulnerability by using certain tools available on the internal network interface to request and view system files. An exploit could allow the attacker to find out sensitive information about the application. Cisco Bug IDs: CSCvf77666.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.010 (62.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 62nd percentile — 62.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
- Cisco Policy Suite — versions 10.0.0, 11.0.0, 11.1.0
- Cisco Policy Suite — versions Cisco Policy Suite
Weakness classification (CWE)
References
- www.securityfocus.com/bid/102758 (VDB Entry, Third Party Advisory, vdb-entry)
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117… (Vendor Advisory)
Frequently asked questions
- What is CVE-2018-0089?
- CVE-2018-0089 is a high-severity vulnerability in Cisco Policy Suite, classified under CWE-264. CVSS score: 7.5/10. Published 2018-01-18.
- How severe is CVE-2018-0089?
- High severity. CVSS v3 base score is 7.5 out of 10.