CVE-2018-0147

This vulnerability is like a “back door” hidden in a piece of network software: if the server receives a carefully crafted Java message, it can be tricked into running attacker commands. Because the issue can run commands with root privileges, an attacker could fully control the machine that runs Cisco ACS, not just a single application.

This matters if you run Cisco Secure Access Control System (ACS), especially if your version is earlier than 5.8 patch 9. The attack does not require an attacker to log in first, because it abuses how the service processes incoming Java data over the network. The real-world risk is highest when the affected Cisco ACS service is reachable from the network (i.e., attackers can reach it), and CISAs KEV indicates it has been exploited in the wild.

This is RED because it is confirmed in the CISA KEV and therefore has a history of real-world exploitation. Attackers can exploit it remotely without authentication, and the impact includes root-level command execution on the affected device. Treat this as an emergency patching priority for any exposed Cisco ACS instance.