CVE-2018-0147

KEV

Cisco Secure Access Control System Java Deserialization Vulnerability

Vendor / Project: Cisco
Product: Secure Access Control System (ACS)
Date added: Mar 25, 2022
Due date: Apr 15, 2022
Known ransomware use: Unknown
CWEs: CWE-20

Description

A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2018-0147