Is CVE-2018-0338 being actively exploited?

CVE-2018-0338 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2018-0338?

CVE-2018-0338 has a CVSS 3.1 base score of 7.8 (HIGH).

CVE-2018-0338

HIGH · CVSS 7.8EPSS 0.4%EU EUVD

A vulnerability in the role-based access-checking mechanisms of Cisco Unified Computing System (UCS) Software could allow an authenticated, local attacker to execute arbitrary commands on an affected system. The vulnerability exists because the affected software lacks proper input and validation checks for certain file systems. An attacker could exploit this vulnerability by issuing crafted commands in the CLI of an affected system. A successful exploit could allow the attacker to cause other users to execute unwanted arbitrary commands on the affected system. Cisco Bug IDs: CSCvf52994.

Key facts

CVSS score: 7.8 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-20
EPSS score: 0.4% (29th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2018-1161)
Published: June 7, 2018
NVD last modified: June 17, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2018-1161 in the EU Vulnerability Database. Last updated in EUVD on November 29, 2024.

View on the EU Vulnerability Database

Affected products

cisco / unified computing system
cisco / unified computing system
cisco / unified computing system
cisco / unified computing system
cisco / unified computing system

Certified products that may be affected

1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.

CISCO ADAPTIVE SECURITY APPLIANCES (ASA) AND CISCO ADAPTIVE SECURITY APPLIANCES VIRTUAL (ASAV) Version: ASA 9.4(1.13), ASAv 9.4(1.240) ASDM 7.4Components: ASA 5500 Series (5506-X, 5506-H, 5506-W, 5508-X, 5516-X) and ASAv running on VM ESXi 5.1 and 5.5 on the Unified Computing System (UCS) EN120E, EN120S M2, E140S M1, E140S M2, E140D M1, E160D M2, E160D M1, E180D M2, E140DP M1, E160DP M1, C22 M3, C24 M3, C220 M3, C220 M4, C240 M3, C240 M4, C260 M2, C420 M3, C460 M2, and C460 M4 - Cisco Systems, Inc. - Common Criteria Certificate Number: 2016/102 - archived

References

http://www.securityfocus.com/bid/104456(Third Party Advisory, VDB Entry)
http://www.securitytracker.com/id/1041071(Third Party Advisory, VDB Entry)
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-ucs-access(Vendor Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain