CVE-2018-0321

CRITICAL

A vulnerability in Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to access the Java Remote Method Invocation (RMI) system. The vulnerability is due to an open port in the Network Interface and Configuration Engine (NICE) service. An attacker could exploit this vulnerability by accessing the open RMI system on an affected PCP instance. An exploit could allow the attacker to perform malicious actions that affect PCP and the devices that are connected to it. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 11.6 and prior. Cisco Bug IDs: CSCvd61746.

Published: Jun 7, 2018 Modified: Jun 17, 2026

CWE-287 CWE-287

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (3)

Vendor	Product	Version
cisco	prime_collaboration	*
cisco	prime_collaboration_assurance	*
cisco	prime_collaboration_provisioning	*

GitHub Security Advisory GHSA-33wg-wpq3-mx7x

A vulnerability in Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated,...

References (6)

http://www.securityfocus.com/bid/104409 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041085 Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-rmi Vendor Advisory
http://www.securityfocus.com/bid/104409 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041085 Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-rmi Vendor Advisory

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 3.57%

Top 12% most likely to be exploited

Threat Score 40.3 / 100

Data Sources

NVD EPSS GitHub