Cisco IOS 802.1x Multiple-Authentication improper authentication

Summaryinfo

A vulnerability has been found in Cisco IOS and classified as critical. This affects an unknown function of the component 802.1x Multiple-Authentication. Performing a manipulation results in improper authentication. This vulnerability is reported as CVE-2018-0163. The attacker must have access to the local network to execute the attack. No exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, was found in Cisco IOS (Router Operating System) (the affected version unknown). This affects an unknown part of the component 802.1x Multiple-Authentication. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the 802.1x multiple-authentication (multi-auth) feature of Cisco IOS Software could allow an unauthenticated, adjacent attacker to bypass the authentication phase on an 802.1x multi-auth port. The vulnerability is due to a logic change error introduced into the code. An attacker could exploit this vulnerability by trying to access an 802.1x multi-auth port after a successful supplicant has authenticated. An exploit could allow the attacker to bypass the 802.1x access controls and obtain access to the network. Cisco Bug IDs: CSCvg69701.

The bug was discovered 03/28/2018. The weakness was disclosed 03/28/2018 with Cisco as cisco-sa-20180328-dot1x as confirmed advisory (Website). It is possible to read the advisory at tools.cisco.com. This vulnerability is uniquely identified as CVE-2018-0163 since 11/27/2017. The attack needs to be done within the local network. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 01/17/2020).

The commercial vulnerability scanner Qualys is able to test this issue with plugin 316230 (Cisco IOS Software 802.1x Multiple-Authentication Port Authentication Bypass Vulnerability(cisco-sa-20180328-dot1x)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 103571†). The entry VDB-115166 is pretty similar. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion