Sign-up

ID

VAR-201803-1381


CVE

CVE-2018-0163


TITLE

Cisco IOS Software authentication vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2018-003567

DESCRIPTION

A vulnerability in the 802.1x multiple-authentication (multi-auth) feature of Cisco IOS Software could allow an unauthenticated, adjacent attacker to bypass the authentication phase on an 802.1x multi-auth port. The vulnerability is due to a logic change error introduced into the code. An attacker could exploit this vulnerability by trying to access an 802.1x multi-auth port after a successful supplicant has authenticated. An exploit could allow the attacker to bypass the 802.1x access controls and obtain access to the network. Cisco Bug IDs: CSCvg69701. Vendors have confirmed this vulnerability Bug ID CSCvg69701 It is released as.Information may be tampered with. This may lead to further attacks

Trust: 2.61

sources: NVD: CVE-2018-0163 // JVNDB: JVNDB-2018-003567 // CNVD: CNVD-2018-08184 // BID: 103571 // VULHUB: VHN-118365 // VULMON: CVE-2018-0163

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2018-08184

AFFECTED PRODUCTS

vendor:ciscomodel:iosscope:eqversion:15.7\(3\)m2

Trust: 1.6

vendor:ciscomodel:iosscope:eqversion:15.6\(3\)m1a

Trust: 1.6

vendor:ciscomodel:iosscope:eqversion:15.6\(3\)m2a

Trust: 1.6

vendor:ciscomodel:iosscope:eqversion:15.7\(3\)m

Trust: 1.6

vendor:ciscomodel:iosscope:eqversion:15.7\(3\)m0a

Trust: 1.6

vendor:ciscomodel:iosscope:eqversion:15.7\(3\)m1

Trust: 1.6

vendor:ciscomodel:iosscope:eqversion:15.6\(3\)m2

Trust: 1.6

vendor:ciscomodel:iosscope:eqversion:15.6\(3\)m3

Trust: 1.6

vendor:ciscomodel:iosscope:eqversion:15.6\(3\)m3a

Trust: 1.6

vendor:ciscomodel:iosscope:eqversion:15.6\(3\)m1

Trust: 1.6

vendor:ciscomodel:iosscope: - version: -

Trust: 1.4

vendor:ciscomodel:iosscope:eqversion:15.4\(3\)m7a

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.6\(2\)t1

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.4\(3\)m7

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.6\(3\)m1b

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(3\)m5

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(3\)m4a

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.6\(3\)m

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.6\(1\)t2

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(3\)m6a

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.4\(3\)m6

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(3\)m4b

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(3\)m6

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(3\)m3

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.6\(2\)t3

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.6\(3\)m0a

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.4\(3\)m6a

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.6\(2\)t2

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(3\)m5a

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(3\)m4

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(3\)m4c

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.6\(1\)t3

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.4\(3\)m8

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.4\(3.0i\)m6

Trust: 1.0

vendor:ciscomodel:ios 15.7 m2scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.7 m1scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.7 m0ascope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.7 mscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.6 m3ascope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.6 m3scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.6 m2ascope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.6 m2scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.6 m1bscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.6 m1ascope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.6 m1scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.6 m0ascope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.6 mscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.6 t3scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.6 t2scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.6 t1scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.6 tscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.5 m5ascope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.5 m5scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.5 m4cscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.5 m4bscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.5 m4ascope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.4 m8scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.4 m7ascope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.4 m7scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.4 m6ascope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.4 m6scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.4 m5scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.4 m3scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 15.4 mscope: - version: -

Trust: 0.3

sources: CNVD: CNVD-2018-08184 // BID: 103571 // JVNDB: JVNDB-2018-003567 // CNNVD: CNNVD-201803-1028 // NVD: CVE-2018-0163

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-0163
value: MEDIUM

Trust: 1.0

NVD: CVE-2018-0163
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2018-08184
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201803-1028
value: MEDIUM

Trust: 0.6

VULHUB: VHN-118365
value: LOW

Trust: 0.1

VULMON: CVE-2018-0163
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2018-0163
severity: LOW
baseScore: 3.3
vectorString: AV:A/AC:L/AU:N/C:N/I:P/A:N
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.5
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2018-08184
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-118365
severity: LOW
baseScore: 3.3
vectorString: AV:A/AC:L/AU:N/C:N/I:P/A:N
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.5
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-0163
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2018-0163
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2018-08184 // VULHUB: VHN-118365 // VULMON: CVE-2018-0163 // JVNDB: JVNDB-2018-003567 // CNNVD: CNNVD-201803-1028 // NVD: CVE-2018-0163

PROBLEMTYPE DATA

problemtype:CWE-287

Trust: 1.9

sources: VULHUB: VHN-118365 // JVNDB: JVNDB-2018-003567 // NVD: CVE-2018-0163

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-201803-1028

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-201803-1028

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-003567

PATCH
title:cisco-sa-20180328-dot1xurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dot1x
Trust: 0.8
title:Cisco IOS Software authentication bypass vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/126853
Trust: 0.6
title:Cisco IOS Software Remediation measures for authorization problem vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=79496
Trust: 0.6
title:Cisco: Cisco IOS Software 802.1x Multiple-Authentication Port Authentication Bypass Vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-20180328-dot1x
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2018-08184 // 
            
            
            
            VULMON: CVE-2018-0163 // 
            
            
            
            JVNDB: JVNDB-2018-003567 // 
            
            
            
            CNNVD: CNNVD-201803-1028

EXTERNAL IDS
db:NVDid:CVE-2018-0163
Trust: 3.5
db:BIDid:103571
Trust: 2.1
db:JVNDBid:JVNDB-2018-003567
Trust: 0.8
db:CNNVDid:CNNVD-201803-1028
Trust: 0.7
db:CNVDid:CNVD-2018-08184
Trust: 0.6
db:VULHUBid:VHN-118365
Trust: 0.1
db:VULMONid:CVE-2018-0163
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2018-08184 // 
            
            
            
            VULHUB: VHN-118365 // 
            
            
            
            VULMON: CVE-2018-0163 // 
            
            
            
            BID: 103571 // 
            
            
            
            JVNDB: JVNDB-2018-003567 // 
            
            
            
            CNNVD: CNNVD-201803-1028 // 
            
            
            
            NVD: CVE-2018-0163

REFERENCES
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20180328-dot1x
Trust: 2.2
url:http://www.securityfocus.com/bid/103571
Trust: 1.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-0163
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-0163
Trust: 0.8
url:https://bst.cloudapps.cisco.com/bugsearch/bug/cscvg69701
Trust: 0.6
url:http://www.cisco.com/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/287.html
Trust: 0.1
url:https://www.rapid7.com/db/vulnerabilities/cisco-ios-cve-2018-0163
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2018-08184 // 
            
            
            
            VULHUB: VHN-118365 // 
            
            
            
            VULMON: CVE-2018-0163 // 
            
            
            
            BID: 103571 // 
            
            
            
            JVNDB: JVNDB-2018-003567 // 
            
            
            
            CNNVD: CNNVD-201803-1028 // 
            
            
            
            NVD: CVE-2018-0163

CREDITS
Cisco
Trust: 0.3
sources:
            
            
            BID: 103571

SOURCES
db:CNVDid:CNVD-2018-08184
db:VULHUBid:VHN-118365
db:VULMONid:CVE-2018-0163
db:BIDid:103571
db:JVNDBid:JVNDB-2018-003567
db:CNNVDid:CNNVD-201803-1028
db:NVDid:CVE-2018-0163

LAST UPDATE DATE
2024-11-23T22:52:11.566000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-08184date:2018-04-24T00:00:00
db:VULHUBid:VHN-118365date:2019-10-09T00:00:00
db:VULMONid:CVE-2018-0163date:2021-04-28T00:00:00
db:BIDid:103571date:2018-03-28T00:00:00
db:JVNDBid:JVNDB-2018-003567date:2018-05-28T00:00:00
db:CNNVDid:CNNVD-201803-1028date:2019-10-17T00:00:00
db:NVDid:CVE-2018-0163date:2024-11-21T03:37:38.443

SOURCES RELEASE DATE
db:CNVDid:CNVD-2018-08184date:2018-04-24T00:00:00
db:VULHUBid:VHN-118365date:2018-03-28T00:00:00
db:VULMONid:CVE-2018-0163date:2018-03-28T00:00:00
db:BIDid:103571date:2018-03-28T00:00:00
db:JVNDBid:JVNDB-2018-003567date:2018-05-28T00:00:00
db:CNNVDid:CNNVD-201803-1028date:2018-03-29T00:00:00
db:NVDid:CVE-2018-0163date:2018-03-28T22:29:00.750