# CVE-2018-0147

A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a crafted serialized Java object. An exploit could allow the attacker to execute arbitrary commands on the device with root privileges. Cisco Bug IDs: CSCvh25988.

- Page: https://www.vulneraibility.com/cve/CVE-2018-0147
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2022-03-25; CISA due date 2022-04-15
- EPSS: 18.21% (percentile 97.2)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2024-11-08)
- Weakness: CWE-20
- Published: 2018-03-08

## Affected versions

- Cisco Secure Access Control System: affected Cisco Secure Access Control System

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] http://www.securitytracker.com/id/1040463
- [other] http://www.securityfocus.com/bid/103328
- [other] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-acs2
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0147

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.