Cisco Policy Suite vulnerabilities

7 CVEs affecting Cisco Policy Suite, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-40119, published 2021-11-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-0375, published 2018-07-18. Critical severity, CVSS 9.8. EPSS: 3.7% chance of exploitation in the next 30 days. A vulnerability in the Cluster Manager of Cisco Policy Suite before 18.2.0 could allow an unauthenticated, remote attacker to log in to an affected system using the root account, which has default,…
CVE-2018-0377, published 2018-07-18. Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days. A vulnerability in the Open Systems Gateway initiative (OSGi) interface of Cisco Policy Suite before 18.1.0 could allow an unauthenticated, remote attacker to directly connect to the OSGi interface.…
CVE-2018-0376, published 2018-07-18. Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days. A vulnerability in the Policy Builder interface of Cisco Policy Suite before 18.2.0 could allow an unauthenticated, remote attacker to access the Policy Builder interface. The vulnerability is due to…
CVE-2021-40119, published 2021-11-04. Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days. A vulnerability in the key-based SSH authentication mechanism of Cisco Policy Suite could allow an unauthenticated, remote attacker to log in to an affected system as the root user. This…
CVE-2018-0089, published 2018-01-18. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability in the Policy and Charging Rules Function (PCRF) of the Cisco Policy Suite (CPS) could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this…
CVE-2017-6623, published 2017-05-18. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in a script file that is installed as part of the Cisco Policy Suite (CPS) Software distribution for the CPS appliance could allow an authenticated, local attacker to escalate their…
CVE-2017-6781, published 2017-08-17. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the management of shell user accounts for Cisco Policy Suite (CPS) Software for CPS appliances could allow an authenticated, local attacker to gain elevated privileges on an…