CVE-2018-0124

A vulnerability in Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to bypass security protections, gain elevated privileges, and execute arbitrary code. The vulnerability is due to insecure key generation during application configuration. An attacker could exploit this vulnerability by using a known insecure key value to bypass security protections by sending arbitrary requests using the insecure key to a targeted application. An exploit could allow the attacker to execute arbitrary code. This vulnerability affects Cisco Unified Communications Domain Manager releases prior to 11.5(2). Cisco Bug IDs: CSCuv67964.

• CWE-320
• CWE-320

• http://www.securityfocus.com/bid/103114Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040405Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-ucdmVendor Advisory
• http://www.securityfocus.com/bid/103114Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040405Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-ucdmVendor Advisory

Published

Feb 22, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-0118A vulnerability in the web-based management interface of Cis…
• CVE-2018-0119A vulnerability in certain authentication controls in the ac…
• CVE-2018-0120A vulnerability in the web framework of Cisco Unified Commun…
• CVE-2018-0121A vulnerability in the authentication functionality of the w…
• CVE-2018-0122A vulnerability in the CLI of the Cisco StarOS operating sys…4.4
• CVE-2018-0123A Path Traversal vulnerability in the diagnostic shell for C…
• CVE-2018-0125A vulnerability in the web interface of the Cisco RV132W ADS…9.8
• CVE-2018-0127A vulnerability in the web interface of Cisco RV132W ADSL2+ …9.8
• CVE-2018-0128A vulnerability in the web-based management interface of Cis…
• CVE-2018-0129A vulnerability in the web-based management interface of Cis…
• CVE-2018-0130A vulnerability in the use of JSON web tokens by the web-bas…
• CVE-2018-0131A vulnerability in the implementation of RSA-encrypted nonce…