dbcve.org
Digital Network Architecture CenterApplication · Cisco

CVE-2018-0268

CRITICAL · 10.0 CVSS v3.0 Published 2018-05-17
Fix available
A fix is available. Upgrade to after 1.1.3 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A vulnerability in the container management subsystem of Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and gain elevated privileges. This vulnerability is due to an insecure default configuration of the Kubernetes container management subsystem within DNA Center. An attacker who has the ability to access the Kubernetes service port could execute commands with elevated privileges within provisioned containers. A successful exploit could result in a complete compromise of affected containers. This vulnerability affects Cisco DNA Center Software Releases 1.1.3 and prior. Cisco Bug IDs: CSCvi47253.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

A vulnerability in Cisco DNA Center's container management subsystem allows unauthenticated remote attackers to bypass authentication and gain elevated privileges. The issue stems from an insecure default configuration of the Kubernetes container management subsystem, where attackers who can access the Kubernetes service port can execute commands with elevated privileges within provisioned containers, resulting in complete compromise of affected containers.

MitigationUpgrade to a Cisco DNA Center software release newer than 1.1.3. Additionally, restrict network access to the Kubernetes service port to prevent unauthorized external attackers from reaching it.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Digital Network Architecture CenterApplication
Affected:<= 1.1.3

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify Cisco DNA Center version
    Access the Cisco DNA Center administrative interface or use the CLI command 'show version' to determine the currently installed software version.
    Affected if The installed version is 1.1.3 or earlier.
  2. Locate the Kubernetes service port
    Review network documentation or scan internal ranges to identify any service listening on ports typically used for Kubernetes (such as 6443, 10250, 10255).
    Affected if The Kubernetes API server or kubelet port is discovered on the network and is reachable from an untrusted segment.
  3. Verify container management accessibility
    From a system outside the expected management network, attempt to reach the identified Kubernetes service port to confirm external accessibility.
    Affected if The Kubernetes service port responds to connections from networks outside the trusted administrative zone.
  4. Confirm container subsystem configuration
    If access is available, examine the container management subsystem configuration for default or insecure settings that allow unauthenticated command execution.
    Affected if The Kubernetes subsystem permits unauthenticated or elevated privileged operations from the service port.

A Cisco DNA Center installation is affected if it runs version 1.1.3 or earlier and has its Kubernetes service port accessible from networks that are not strictly trusted.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to a release after 1.1.3
Interim mitigation

Upgrade to a Cisco DNA Center software release newer than 1.1.3. Additionally, restrict network access to the Kubernetes service port to prevent unauthorized external attackers from reaching it.

Recommended fix High confidence

Cisco DNA Center 1.1.4 or later (first fixed release is 1.1.4)

  1. 1. Back up the current Cisco DNA Center configuration and ensure you have a valid disaster recovery plan in place.
  2. 2. Schedule a maintenance window as the upgrade may require downtime.
  3. 3. Download the Cisco DNA Center software version 1.1.4 or later from the Cisco Software Download center.
  4. 4. Access the Cisco DNA Center admin interface and navigate to the Software Updates section.
  5. 5. Upload the new software image and initiate the upgrade process.
  6. 6. Verify the upgrade was successful by confirming all services are running and the new version is displayed in the UI.
  7. 7. Validate that the Kubernetes container management subsystem is properly configured with secure settings.
Caveat Review Cisco DNA Center release notes for any behavioral changes or migration requirements between versions; some features may have deprecated functionality

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Digital Network Architecture Center Scoped from the published advisory
  • Consultation8.0 h
  • Implementation8.0 h
  • Testing8.0 h
  • Review / QA4.0 h
28.0 hours of engineering $4,960
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $7,936.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2018-0268 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2018-0268 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data