← Vulnerability feed

Vulnerability record · CVE-2018-0141 · published 8 March 2018

CVE-2018-0141: Cisco prime collaboration hard-coded credentials vulnerability

Cisco · Prime Collaboration

A vulnerability in Cisco Prime Collaboration Provisioning (PCP) Software 11.6 could allow an unauthenticated, local attacker to log in to the underlying Linux operating system. The vulnerability is due to a hard-coded account password on the system. An attacker could exploit this vulnerability by connecting to the affected system via Secure Shell (SSH) using the hard-coded credentials. A successful exploit could allow the attacker to access the underlying operating system as a low-privileged user. After low-level privileges are gained, the attacker could elevate to root privileges and take full control of the device. Cisco Bug IDs: CSCvc82982.

8.4 CVSS 3.0 High EPSS 0.42% · top 66.5% CWE-798 · Hard-coded credentials
8.4CVSS 3.0 base score, v2 7.2
0.42%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

A vulnerability in Cisco Prime Collaboration Provisioning (PCP) Software 11.6 could allow an unauthenticated, local attacker to log in to the underlying Linux operating system. The vulnerability is due to a hard-coded account password on the system. An attacker could exploit this vulnerability by connecting to the affected system via Secure Shell (SSH) using the hard-coded credentials. A successful exploit could allow the attacker to access the underlying operating system as a low-privileged user. After low-level privileges are gained, the attacker could elevate to root privileges and take full control of the device. Cisco Bug IDs: CSCvc82982.

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/103329 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040462 Third Party AdvisoryVDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-cpcp Vendor Advisory
http://www.securityfocus.com/bid/103329 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040462 Third Party AdvisoryVDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-cpcp Vendor Advisory

Track CVE-2018-0141 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-15389Cisco prime collaboration hard-coded credentials vulnerabilityA vulnerability in the install function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to access the…EPSS 1.5%9.8CVE-2018-0318Cisco prime collaboration improper authentication vulnerabilityA vulnerability in the password reset function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to gai…EPSS 3.1%9.8CVE-2018-0319Cisco prime collaboration improper authentication vulnerabilityA vulnerability in the password recovery function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to …EPSS 3.1%9.8CVE-2018-0320Cisco prime collaboration sql injection vulnerabilityA vulnerability in the web framework code of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to execute …EPSS 4.0%9.8CVE-2018-0321Cisco prime collaboration improper authentication vulnerabilityA vulnerability in Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to access the Java Remote Method Invo…EPSS 3.6%9.8CVE-2017-6622Cisco Prime Collaboration Provisioning auth bypass and root command injectionCisco Prime Collaboration Provisioning's web interface lacks security constraints on certain HTTP request methods, allowing an unauthenticated remote…EPSS 62%analysed9.8CVE-2016-1416Cisco prime collaboration provisioning permissions and access controls vulnerabilityCisco Prime Collaboration Provisioning 10.6 SP2 (aka 10.6.0.10602) mishandles LDAP authentication, which allows remote attackers to obtain administra…EPSS 4.5%9.1CVE-2019-1662Cisco prime collaboration assurance improper authentication vulnerabilityA vulnerability in the Quality of Voice Reporting (QOVR) service of Cisco Prime Collaboration Assurance (PCA) Software could allow an unauthenticated…EPSS 1.8%

Source: NIST National Vulnerability Database (record CVE-2018-0141), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.