Policy Suite
Vendor:
First CVE: May 18, 2017 · Active for 9 years
7
Total CVEs
More Total CVEs than 85% of tracked products
2.3
Avg CVEs / Year
Higher CVE frequency than 76% of tracked products
8.5
Avg CVSS
Higher Avg CVSS than 77% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Policy Suite over time
Volume of CVEsAvg CVSS Base Score
First CVE
May 18, 2017
9 years ago
Most Recent CVE
Nov 4, 2021
1,727 days ago
CVE Severity & Scoring
Policy Suite7 CVEs
14%
29%
57%
All CVEs353,173 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local2 (28.6%)
Network5 (71.4%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low7 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None7 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low2 (28.6%)
High0 (0.0%)
None5 (71.4%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-0377CRITICAL A vulnerability in the Open Systems Gateway initiative (OSGi) interface of Cisco Policy Suite before 18.1.0 could allow an unauthenticated, remote attacker to directly connect to t | Jul 18, 2018 | 9.8 | 32 | NO | NO |
CVE-2018-0375CRITICAL A vulnerability in the Cluster Manager of Cisco Policy Suite before 18.2.0 could allow an unauthenticated, remote attacker to log in to an affected system using the root account, w | Jul 18, 2018 | 9.8 | 32 | NO | NO |
CVE-2021-40119CRITICAL A vulnerability in the key-based SSH authentication mechanism of Cisco Policy Suite could allow an unauthenticated, remote attacker to log in to an affected system as the root user | Nov 4, 2021 | 9.8 | 31 | NO | NO |
CVE-2018-0376CRITICAL A vulnerability in the Policy Builder interface of Cisco Policy Suite before 18.2.0 could allow an unauthenticated, remote attacker to access the Policy Builder interface. The vuln | Jul 18, 2018 | 9.8 | 30 | NO | NO |
CVE-2017-6623HIGH A vulnerability in a script file that is installed as part of the Cisco Policy Suite (CPS) Software distribution for the CPS appliance could allow an authenticated, local attacker | May 18, 2017 | 7.8 | 24 | NO | NO |
CVE-2018-0089HIGH A vulnerability in the Policy and Charging Rules Function (PCRF) of the Cisco Policy Suite (CPS) could allow an unauthenticated, remote attacker to access sensitive data. The attac | Jan 18, 2018 | 7.5 | 23 | NO | NO |
CVE-2017-6781MEDIUM A vulnerability in the management of shell user accounts for Cisco Policy Suite (CPS) Software for CPS appliances could allow an authenticated, local attacker to gain elevated priv | Aug 17, 2017 | 5.3 | 18 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (7 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (7 CVEs).
Media Mentions
Signals from CVEs in this product scope (7 CVEs).
Top CNAs Publishing CVEs For Policy Suite
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 9.1.0 | 1 | 5.3 | 0.3% | 0 | 0 |
| 9.0.0 | 1 | 5.3 | 0.3% | 0 | 0 |
| 12.0.0 | 1 | 5.3 | 0.3% | 0 | 0 |
| 11.1.0 | 1 | 7.5 | 1.0% | 0 | 0 |
| 11.0.0 | 3 | 6.9 | 0.5% | 0 | 0 |
| 10.1.0 | 1 | 7.8 | 0.3% | 0 | 0 |
| 10.0.0 | 3 | 6.9 | 0.5% | 0 | 0 |