CVE-2018-0147

This vulnerability is like a “back door” hidden in a piece of network software: if the server receives a carefully crafted Java message, it can be tricked into running attacker commands. Because the issue can run commands with root privileges, an attacker could fully control the machine that runs Cisco ACS, not just a single application.

This matters if you run Cisco Secure Access Control System (ACS), especially if your version is earlier than 5.8 patch 9. The attack does not require an attacker to log in first, because it abuses how the service processes incoming Java data over the network. The real-world risk is highest when the affected Cisco ACS service is reachable from the network (i.e., attackers can reach it), and CISAs KEV indicates it has been exploited in the wild.

This is RED because it is confirmed in the CISA KEV and therefore has a history of real-world exploitation. Attackers can exploit it remotely without authentication, and the impact includes root-level command execution on the affected device. Treat this as an emergency patching priority for any exposed Cisco ACS instance.

1. Confirm exposure (inventory and reachability)

   • Determine whether you use Cisco Secure Access Control System (ACS).
   • Confirm the installed ACS version/build and whether it is prior to 5.8 patch 9.
   • Confirm whether the ACS service that processes the vulnerable component is reachable from untrusted networks (e.g., the public internet or other networks that attackers can access).

2. Validate against the fixed version

   • The vendor fix requires moving to Cisco Secure Access Control System (ACS) version 5.8 patch 9 or later.
   • Follow Cisco’s advisory guidance for the upgrade path appropriate to your current release.

3. Upgrade and verification

   • Apply the vendor-recommended update(s) to reach 5.8 patch 9 or later.
   • After upgrading, verify ACS is running correctly and that authentication/authorization flows still work as expected.
   • Confirm that the system is no longer vulnerable by checking the installed version and reviewing post-upgrade status.

4. Temporary workaround while patching (if immediate upgrade is not possible)

   • Reduce exposure: ensure the ACS management/service interfaces related to inbound processing are not reachable from untrusted networks.
   • Use network controls (firewall rules / segmentation) to limit access to only required trusted networks or admin hosts.
   • Keep logs/sensor coverage focused on the ACS host during the patch window.

5. Monitor after remediation

   • Watch for suspicious activity targeting the ACS host (unexpected inbound requests to the ACS service, unusual process execution, or configuration changes) and ensure alerts/monitoring are enabled for the ACS server.

CISA due date noted by KEV: 2022-04-15 (this is historical guidance, but it indicates the urgency level already assessed by CISA).

Severity and impact: This is a critical remote code execution issue with root command execution described for Cisco Secure Access Control System (ACS) versions earlier than 5.8 patch 9. Mechanism: the vulnerability is due to insecure Java deserialization of attacker-supplied data; a remote attacker can send a crafted serialized Java object that causes arbitrary command execution. Authentication/interaction: the findings state no authentication is required; user interaction is not specified in the findings. Exploitation status: CISA KEV confirms it is exploited in the real world (listed and with a published remediation due date). Exploit availability: no public exploit code is on record in the provided findings, but KEV status still drives the remediation urgency. Prediction: EPSS is provided as a prediction and is not used as the decision driver because KEV is confirmed.