Vulnerability in Cisco Meraki M5
CVE-2018-0284
A vulnerability in the local status page functionality of the Cisco Meraki MR, MS, MX, Z1, and Z3 product lines could allow an authenticated, remote attacker to modify device configuration files. The vulnerability occurs when handling requests to the local status page. An exploit could allow the attacker to establish an interactive session to the device with elevated privileges. The attacker could then use the elevated privileges to further compromise the device or obtain additional configuration data from the device that is being exploited.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.016 (74.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 74th percentile — 74.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.016 · newest: 0.016 · change: 0.000
Affected products
- Cisco Meraki M5 — versions <9.37
- Cisco Meraki Mr — versions <24.13
- Cisco Meraki Mx — versions <13.32
- Cisco Meraki Z1 — versions <13.32
- Cisco Meraki Z3 — versions <13.32
- Cisco Meraki Mr
- Cisco Meraki Mr 24 Firmware
- Cisco Meraki Mr 25 Firmware
- Cisco Meraki Ms
- Cisco Meraki Ms 10 Firmware
Weakness classification (CWE)
References
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107… (vendor-advisory, Vendor Advisory)
- www.securityfocus.com/bid/105878 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2018-0284?
- CVE-2018-0284 is a medium-severity vulnerability in Cisco Meraki M5, classified under CWE-264. CVSS score: 6.5/10. Published 2018-11-08.
- How severe is CVE-2018-0284?
- Medium severity. CVSS v3 base score is 6.5 out of 10.