Cisco Secure Access Control System Java Deserialization Vulnerability

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a crafted serialized Java object. An exploit could allow the attacker to execute arbitrary commands on the device with root privileges. Cisco Bug IDs: CSCvh25988.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• securitytracker.com/id/1040463 Diğer
• securityfocus.com/bid/103328 Diğer
• tools.cisco.com/…t/CiscoSecurityAdvisory/cisco-sa-20180307-acs2 Diğer

Kayıt geçmişi

1. 25 Mar 2022CISA KEV listesine eklendi (saldırılarda kullanılıyor)
2. 8 Mar 2018 10:00Yayımlandı

İlgili açıklar

• 3,7 CVE-2026-21830HCL BigFix AEX is affected by multiple security vulnerabilities.
• 8,8 CVE-2026-118315Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially exe…
• 8,8 CVE-2026-118314Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to po…
• 8,8 CVE-2026-118335Improper input validation in Metrics in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to p…
• 8,8 CVE-2026-118304Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially exe…
• 8,8 CVE-2026-118343Improper input validation in ReadingList in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potenti…