CVE-2018-0254
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass configured file action policies if Intelligent Application Bypass (IAB) with a drop percentage threshold is also configured. The issue is due to incorrect counting of dropped traffic percentage. An attacker could send network traffic to the device, bypassing policies and allowing traffic that should be dropped.
Risk Assessment
Bypassing file action policies could allow malicious files to enter the network, potentially leading to infections and security breaches.
Recommendation
It is recommended to update Firepower software to patched versions and review IAB and file policy configurations.
Original NVD description (English source)
A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass configured file action policies if an Intelligent Application Bypass (IAB) with a drop percentage threshold is also configured. The vulnerability is due to incorrect counting of the percentage of dropped traffic. An attacker could exploit this vulnerability by sending network traffic to a targeted device. An exploit could allow the attacker to bypass configured file action policies, and traffic that should be dropped could be allowed into the network. Cisco Bug IDs: CSCvf86435.