Back

CVE-2018-15439

CRITICAL

A vulnerability in the Cisco Small Business Switches software could allow an unauthenticated, remote attacker to bypass the user authentication mechanism of an affected device. The vulnerability exists because under specific circumstances, the affected software enables a privileged user account without notifying administrators of the system. An attacker could exploit this vulnerability by using this account to log in to an affected device and execute commands with full admin rights. Cisco has not released software updates that address this vulnerability. This advisory will be updated with fixed software information once fixed software becomes available. There is a workaround to address this vulnerability.

Published: Nov 8, 2018 Modified: Jun 17, 2026
CWE-798 CWE-798

CVSS Metrics

CVSSv3
Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (114)

Vendor Product Version
cisco sg200-50_firmware -
cisco sg200-50p_firmware -
cisco sg200-50fp_firmware -
cisco sg200-26_firmware -
cisco sg200-26p_firmware -
cisco sg200-26fp_firmware -
cisco sg200-18_firmware -
cisco sg200-10fp_firmware -
cisco sg200-08_firmware -
cisco sg200-08p_firmware -
cisco sf200-24_firmware -
cisco sf200-24p_firmware -
cisco sf200-24fp_firmware -
cisco sf200-48_firmware -
cisco sf200-48p_firmware -
cisco sf302-08pp_firmware -
cisco sf302-08mpp_firmware -
cisco sg300-10pp_firmware -
cisco sg300-10mpp_firmware -
cisco sf300-24pp_firmware -

…and 94 more

GitHub Security Advisory GHSA-3f6c-mv48-pf3v

A vulnerability in the Cisco Small Business Switches software could allow an unauthenticated,...

References (4)

Risk Scores

CVSS Score 9.8 / 10
EPSS Score 49.74%

Top 1% most likely to be exploited

Threat Score 54.1 / 100

Data Sources

NVD EPSS GitHub