CVE-2018-0147

What is Cisco Secure ACS?

Cisco Secure Access Control System (ACS) is a centralized AAA (authentication, authorization, and accounting) platform used to control administrative and network access across enterprise switches, routers, VPNs, and wireless infrastructure via RADIUS and TACACS+. Because ACS holds the credentials and policy decisions that gate access to the rest of the network, compromising the ACS server itself is often equivalent to compromising every device it authenticates for.

Overview

CVE-2018-0147 is a critical unauthenticated remote code execution vulnerability in Cisco Secure ACS, caused by insecure deserialization of Java objects submitted to the appliance. An attacker who can reach the ACS management or service interface over the network can submit a specially crafted serialized object that, when deserialized by the application, triggers execution of arbitrary commands with elevated (root-level) privileges — no valid credentials or user interaction required. The CVSS score of 9.8 reflects full compromise of confidentiality, integrity, and availability with no attacker prerequisites.

Technical Details

The flaw is rooted in Java deserialization (tracked generically here under CWE-20, improper input validation of the deserialized stream) — a class of vulnerability that became widely understood industry-wide following the 2015 Apache Commons Collections gadget-chain research, which showed that many Java applications accepting serialized objects from untrusted sources could be coerced into executing attacker-controlled code during the deserialization process itself, before any application-level authentication check runs. ACS's exposure of a deserialization endpoint to the network, without adequate validation of object types or provenance, gave remote attackers a direct path to command execution.

Discovery

Cisco addressed the vulnerability through its standard PSIRT disclosure process in March 2018, as part of a bundle of ACS-related security advisories. No independent researcher is publicly credited for this specific finding.

Exploitation Context

Java deserialization RCE bugs of this type are attractive to attackers because they typically require a single crafted network request and no authentication. CISA's addition of CVE-2018-0147 to the KEV catalog confirms it has seen use in real-world attacks. Given ACS's role as a central AAA authority, compromise of an ACS instance can expose the credential and policy database controlling access to an organization's entire switch and VPN estate, making it a high-value target for attackers seeking lateral movement across network infrastructure.

Remediation

1. Identify all Cisco Secure ACS deployments and confirm their current software version.
2. Apply the Cisco-published patched release identified in the corresponding security advisory.
3. Restrict network access to the ACS management interface to trusted administrative subnets only.
4. Since Secure ACS reached end-of-life status industry-wide, evaluate migration to Cisco Identity Services Engine (ISE) or another actively supported AAA platform.
5. Audit AAA logs for anomalous administrative actions or unexpected service restarts that could indicate prior exploitation.