CVE-2018-7066
CRITICAL
9,0
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: changed
Confidentiality: high
Integrity: high
Availability: high
HIGH
9,3
Source: [email protected]
Access Vector: network
Access Complexity: medium
Authentication: none
Confidentiality: complete
Integrity: complete
Availability: complete
Description
AI Translation Available
An unauthenticated remote command execution exists in Aruba ClearPass Policy Manager on linked devices. The ClearPass OnConnect feature permits administrators to link other network devices into ClearPass for the purpose of collecting enhanced information about connected endpoints. A defect in the API could allow a remote attacker to execute arbitrary commands on one of the linked devices. This vulnerability is only applicable if credentials for devices have been supplied to ClearPass under Configuration -> Network -> Devices -> CLI Settings. Resolution: Fixed in 6.7.5 and 6.6.10-hotfix.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0184
Percentile
0,8th
Updated
EPSS Score Trend (Last 90 Days)
Application
Clearpass Policy Manager by Arubanetworks
Version Range Affected
To
6.6.10
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Clearpass Policy Manager by Arubanetworks
Version Range Affected
From
6.7.0
(inclusive)
To
6.7.5
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-007.txt
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-007.txt