Skip to content
CVE Tracker
Back

CVE-2018-0147

A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an…

Critical9.8Known exploitedEPSS 18.2%
Published
Updated
Reserved
Assigned by
cisco

Description

A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a crafted serialized Java object. An exploit could allow the attacker to execute arbitrary commands on the device with root privileges. Cisco Bug IDs: CSCvh25988.

Exploited in the wild

CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Cisco Secure Access Control System Java Deserialization Vulnerability.

Added
25 Mar 2022
Fix due (US federal)
15 Apr 2022
Used by ransomware
Not known

Apply updates per vendor instructions.

Scores

CVSS scores of CVE-2018-0147, by who scored it
Scored byCVSSScoreVector
CISA-ADPADP (enrichment)3.1Critical9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Analyzed3.1Critical9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
18.2% · top 2.8% of all CVEs (2 Nov 2026)
CISA SSVC
Exploitation: active · Automatable: yes · Technical impact: total

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

Affected products

  • Cisco Secure Access Control System

    • affected Cisco Secure Access Control System

References (4)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .