CVE-2018-0130

A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, remote attacker to gain administrative access to an affected system. The vulnerability is due to the presence of static default credentials for the web-based service portal of the affected software. An attacker could exploit this vulnerability by extracting the credentials from an image of the affected software and using those credentials to generate a valid administrative session token for the web-based service portal of any other installation of the affected software. A successful exploit could allow the attacker to gain administrative access to the web-based service portal of an affected system. This vulnerability affects Cisco Elastic Services Controller Software Release 3.0.0. Cisco Bug IDs: CSCvg30884.

• CWE-264
• CWE-1188

• http://www.securityfocus.com/bid/103116Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-esc1Vendor Advisory
• http://www.securityfocus.com/bid/103116Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-esc1Vendor Advisory

Published

Feb 22, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-0123A Path Traversal vulnerability in the diagnostic shell for C…
• CVE-2018-0124A vulnerability in Cisco Unified Communications Domain Manag…
• CVE-2018-0125A vulnerability in the web interface of the Cisco RV132W ADS…9.8
• CVE-2018-0127A vulnerability in the web interface of Cisco RV132W ADSL2+ …9.8
• CVE-2018-0128A vulnerability in the web-based management interface of Cis…
• CVE-2018-0129A vulnerability in the web-based management interface of Cis…
• CVE-2018-0131A vulnerability in the implementation of RSA-encrypted nonce…
• CVE-2018-0132A vulnerability in the forwarding information base (FIB) cod…
• CVE-2018-0134A vulnerability in the RADIUS authentication module of Cisco…5.3
• CVE-2018-0135A vulnerability in Cisco Unified Communications Manager coul…
• CVE-2018-0136A vulnerability in the IPv6 subsystem of Cisco IOS XR Softwa…8.6
• CVE-2018-0137A vulnerability in the TCP throttling process of Cisco Prime…