Critical Java Deserialization RCE in Cisco Secure Access Control System (CVE‑2018‑0147)
What It Is – Cisco Secure Access Control System (ACS) contains a Java deserialization flaw that allows an unauthenticated, remote attacker to execute arbitrary OS commands. The issue stems from insecure handling of attacker‑controlled serialized objects.
Exploitability – The vulnerability is publicly disclosed, has an assigned CVSS 9.8 (Critical) score, and proof‑of‑concept code exists. No patch was available at the time of the advisory; Cisco later released a security update.
Affected Products – Cisco Secure Access Control System (ACS) – all versions prior to the security‑update release (see Cisco advisory for exact version numbers).
Why It Matters for Trust & Control Assurance
- Control Objective – Secure Access Control Services – A remote code execution flaw in an authentication/authorization platform undermines the assurance that only legitimate users can access network resources.
- Continuous Monitoring – Detecting unexpected process launches or command‑line activity on ACS devices is essential evidence for an audit trail.
- Patch Management Evidence – Demonstrating timely remediation of high‑severity CVEs satisfies multiple framework controls (e.g., NIST CSF “Protect” and ISO 27001 “Asset Management”).
Recommended Actions
- Verify the ACS version against Cisco’s advisory and apply the released patch immediately.
- Conduct a focused inventory of all ACS deployments and map the patch status to your control framework.
- Enable detailed logging of ACS command execution and integrate logs into a SIEM for continuous evidence collection.
- Update your vulnerability‑management program to include deserialization checks for Java‑based services.
Source: CISA KEV – CVE‑2018‑0147