CVE-2018-0147
Cisco Secure Access Control System Java Deserialization Vulnerability
Description
CVE-2018-0147 is a critical insecure deserialization vulnerability in Cisco Secure Access Control System (ACS) that allows an unauthenticated remote attacker to execute arbitrary commands on the affected system via specially crafted Java deserialization payloads. The vulnerability exists because Cisco Secure ACS improperly deserializes user-supplied content, enabling remote code execution with the privileges of the application. CISA has added CVE-2018-0147 to the Known Exploited Vulnerabilities catalog due to confirmed active exploitation. With an EPSS score of 4.0% (94.1st percentile), this vulnerability represents a significant risk to organizations running unpatched Cisco Secure ACS deployments.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | secure access control system | 5.2\(0.3\) |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/103328(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1040463(Third Party Advisory, VDB Entry)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-acs2(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0147(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CWE-502 describes a weakness where an application deserializes untrusted data without sufficient verification that the resulting data will be valid and safe. In CVE-2018-0147, Cisco Secure ACS deserializes Java objects from user-supplied input without proper validation, allowing an attacker to submit malicious serialized objects that, when deserialized, execute arbitrary commands on the server.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2018-0147 enables unauthenticated remote code execution on Cisco Secure Access Control System, which is a centralized authentication, authorization, and accounting (AAA) server used to manage network access policies across enterprise environments. Compromise of a Cisco Secure ACS instance can give attackers control over the organization's entire network access control infrastructure, enabling them to create unauthorized access policies, bypass network authentication requirements, and grant themselves persistent access to all network resources managed by the ACS. Since the ACS manages authentication for network devices such as routers, switches, firewalls, and VPN concentrators, a compromised ACS can serve as a skeleton key to the entire network infrastructure. The EPSS score of 4.0% (94.1st percentile) indicates significant exploitation activity, particularly given the high strategic value of AAA infrastructure as a target.
Exploit Maturity
CVE-2018-0147 is actively exploited in the wild, as confirmed by its inclusion in the CISA Known Exploited Vulnerabilities catalog. Java deserialization vulnerabilities are a well-understood attack class with mature tooling and public exploit frameworks such as ysoserial that can generate deserialization payloads for various Java application servers. The EPSS score of 4.0% (94.1st percentile) reflects meaningful exploitation activity. While the EPSS score is lower than some other critical vulnerabilities, the high strategic value of AAA infrastructure makes Cisco Secure ACS a particularly attractive target for advanced threat actors seeking persistent network access.
Remediation
- Apply Cisco security patches immediately by updating Cisco Secure ACS to the version specified in Cisco Security Advisory cisco-sa-20180307-acs2, as required by the CISA KEV directive.
- If Cisco Secure ACS has reached end-of-life, migrate to Cisco Identity Services Engine (ISE), which is the successor product and receives active security updates.
- Restrict network access to the Cisco Secure ACS management and service interfaces to trusted management networks only, ensuring they are not accessible from untrusted network segments.
- Audit the Cisco Secure ACS configuration for unauthorized access policies, unexpected administrator accounts, or modified authentication rules that may indicate prior exploitation.
- Review network access logs and AAA accounting records for anomalous authentication events, unauthorized network access grants, or suspicious administrative activity that could indicate compromise of the ACS infrastructure.
Technical Details
CVE-2018-0147 is a Java deserialization vulnerability (CWE-502) in Cisco Secure Access Control System. The vulnerability exists because the application accepts and deserializes Java objects from user-supplied input without adequate validation. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted serialized Java object to the vulnerable service. When the ACS application deserializes this object, it triggers the execution of arbitrary code on the underlying operating system with the privileges of the application process. Java deserialization attacks leverage the behavior of Java's ObjectInputStream class, which can instantiate arbitrary objects during deserialization, and these objects' lifecycle methods can be chained to execute commands. Cisco Secure ACS is a RADIUS and TACACS+ server used for centralized AAA in enterprise networks, making it a critical infrastructure component whose compromise has far-reaching consequences.
Frequently Asked Questions
Is CVE-2018-0147 being actively exploited?
Yes, CVE-2018-0147 is actively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 4.0% (94.1st percentile) confirms meaningful exploitation activity. Java deserialization attacks are well-understood with mature tooling, making exploitation straightforward for skilled attackers.
What products are affected by CVE-2018-0147?
CVE-2018-0147 affects Cisco Secure Access Control System (ACS). The vulnerability is in the Java deserialization handling of the application. Consult Cisco Security Advisory cisco-sa-20180307-acs2 for specific affected version information.
How do I fix CVE-2018-0147?
Apply the Cisco security patch as described in cisco-sa-20180307-acs2. If Cisco Secure ACS has reached end-of-life, migrate to Cisco Identity Services Engine (ISE). Restrict network access to the ACS management interfaces to trusted networks only.
How severe is CVE-2018-0147?
CVE-2018-0147 is rated CRITICAL as it enables unauthenticated remote code execution on a centralized authentication, authorization, and accounting server. The EPSS score of 4.0% (94.1st percentile) indicates significant exploitation. Compromise of AAA infrastructure gives attackers the ability to control network access policies for all managed network devices, effectively providing a master key to the organization's network.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.