What’s Vulnerable › Vulnerabilities

CVE-2018-0377

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-07-18 · updated 2026-06-17
• Weakness: CWE-306

Description

A vulnerability in the Open Systems Gateway initiative (OSGi) interface of Cisco Policy Suite before 18.1.0 could allow an unauthenticated, remote attacker to directly connect to the OSGi interface. The vulnerability is due to a lack of authentication. An attacker could exploit this vulnerability by directly connecting to the OSGi interface. An exploit could allow the attacker to access or change any files that are accessible by the OSGi process. Cisco Bug IDs: CSCvh18017.

Affected products

• Cisco Mobility Express 2800 and 3800 Series Wireless LAN Controllers: 14.0.0
• Cisco Policy Suite: before 18.1.0 — fixed in 18.1.0

How to fix

Upgrade to a fixed version: Cisco Policy Suite 18.1.0. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/104850
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-ps-osgi-unauth-access
• http://www.securityfocus.com/bid/104850
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-ps-osgi-unauth-access

Get alerted when CVE-2018-0377 or the next vulnerability affects your stack