What is the CVSS score of CVE-2018-0362?

CVE-2018-0362 has a CVSS 3.0 base score of 4.3 (Medium). CVSS vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.4%.

5400 Enterprise Network Compute System Firmware CVE-2018-0362

MEDIUM

Improper Authentication (CWE-287)

2018-06-21 psirt@cisco.com

Authentication Bypass Cisco 5400 Enterprise Network Compute System Firmware 5100 Enterprise Network Compute System Firmware Ucs E160S M3 Firmware Ucs E160S K9 Firmware Ucs E180D M3 Firmware Ucs E180D K9 Firmware Ucs E1120D M3 Firmware Ucs E1120D K9 Firmware Ucs E140S M2 Firmware Ucs E140S K9 Firmware Ucs E160D M2 Firmware Ucs E160D K9 Firmware Ucs E180D M2 Firmware Ucs E140S M1 Firmware Ucs E160D M1 Firmware Ucs E160Dp M1 Firmware Ucs E160Dp K9 Firmware Ucs E140D M1 Firmware Ucs E140D K9 Firmware Ucs E140Dp M1 Firmware Ucs E140Dp K9 Firmware

4.3

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVE Published

Jun 21, 2018 - 11:29 nvd

MEDIUM 4.3

DescriptionNVD

A vulnerability in BIOS authentication management of Cisco 5000 Series Enterprise Network Compute System and Cisco Unified Computing (UCS) E-Series Servers could allow an unauthenticated, local attacker to bypass the BIOS authentication and execute actions as an unprivileged user. The vulnerability is due to improper security restrictions that are imposed by the affected system. An attacker could exploit this vulnerability by submitting an empty password value to an affected device's BIOS authentication prompt. An exploit could allow the attacker to have access to a restricted set of user-level BIOS commands. Cisco Bug IDs: CSCvh83260.

AnalysisAI

A vulnerability in BIOS authentication management of Cisco 5000 Series Enterprise Network Compute System and Cisco Unified Computing (UCS) E-Series Servers could allow an unauthenticated, local. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. A vulnerability in BIOS authentication management of Cisco 5000 Series Enterprise Network Compute System and Cisco Unified Computing (UCS) E-Series Servers could allow an unauthenticated, local attacker to bypass the BIOS authentication and execute actions as an unprivileged user. The vulnerability is due to improper security restrictions that are imposed by the affected system. An attacker could exploit this vulnerability by submitting an empty password value to an affected device's BIOS authentication prompt. An exploit could allow the attacker to have access to a restricted set of user-level BIOS commands. Cisco Bug IDs: CSCvh83260. Affected products include: Cisco 5400 Enterprise Network Compute System Firmware, Cisco 5100 Enterprise Network Compute System Firmware, Cisco Ucs-E160S-M3 Firmware, Cisco Ucs-E160S-K9 Firmware, Cisco Ucs-E180D-M3 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.