Vulnerability in Cisco Meraki M5
CVE-2018-0284
A vulnerability in the local status page functionality of the Cisco Meraki MR, MS, MX, Z1, and Z3 product lines could allow an authenticated, remote attacker to modify device configuration files. The vulnerability occurs when handling requests to the local status page. An exploit could allow the attacker to establish an interactive session to the device with elevated privileges. The attacker could then use the elevated privileges to further compromise the device or obtain additional configuration data from the device that is being exploited.
EPSS: 0.016 (72.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Cisco Meraki M5 — versions <9.37
- Cisco Meraki Mr — versions <24.13
- Cisco Meraki Mx — versions <13.32
- Cisco Meraki Z1 — versions <13.32
- Cisco Meraki Z3 — versions <13.32
- Cisco Meraki_mr
- Cisco Meraki_mr_24_firmware
- Cisco Meraki_mr_25_firmware
- Cisco Meraki_ms
- Cisco Meraki_ms_10_firmware
Weakness classification (CWE)
References
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
- psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2018-0284?
- CVE-2018-0284 is a medium-severity vulnerability in Cisco Meraki M5, classified under CWE-264. CVSS score: 6.5/10. Published 2018-11-08.
- How severe is CVE-2018-0284?
- Medium severity. CVSS v3 base score is 6.5 out of 10.