CVE-2018-0318 — A vulnerability in the password reset function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device

Back Back to CVE browser

CRITICAL

A vulnerability in the password reset function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device

Published Jun 7, 2018

9.8

CRITICAL

CVSS 3.0

EPSS 3.12%

Description

A vulnerability in the password reset function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device. The vulnerability is due to insufficient validation of a password reset request. An attacker could exploit this vulnerability by submitting a password reset request and changing the password for any user on an affected system. An exploit could allow the attacker to gain administrative-level privileges on the affected system. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 11.6 and prior. Cisco Bug IDs: CSCvd07245.

Affected products

Vendor n/a Product Cisco Prime Collaboration Provisioning unknown Default
n/a
- Version
  Cisco Prime Collaboration Provisioning unknown
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Cisco Prime Collaboration Provisioning unknown

n/a

Version	Status	Constraints
Cisco Prime Collaboration Provisioning unknown	affected	-

Remediation

No remediation recorded yet.

Metrics

3.12% 0.03116

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.03116

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (20 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	3.12% (0.03116)	87.36th	v5 (v2026.06.15)
Jun 15, 2026	3.16% (0.03156)	86.26th	v5 (v2026.06.15)
Mar 25, 2025	2.59% (0.02586)	84.15th	v4 (v2025.03.14)
Jul 20, 2024	0.51% (0.00513)	76.86th	v3 (v2023.03.01)
Feb 10, 2024	0.51% (0.00513)	75.97th	v3 (v2023.03.01)
Dec 8, 2023	0.51% (0.00513)	73.97th	v3 (v2023.03.01)
Oct 29, 2023	0.56% (0.00564)	75.23th	v3 (v2023.03.01)
Jul 8, 2023	0.93% (0.00928)	80.83th	v3 (v2023.03.01)
Jul 6, 2023	1.43% (0.01430)	84.70th	v3 (v2023.03.01)
Jun 1, 2023	1.45% (0.01452)	84.72th	v3 (v2023.03.01)
May 8, 2023	1.51% (0.01512)	84.97th	v3 (v2023.03.01)
Mar 7, 2023	0.98% (0.00982)	81.12th	v3 (v2023.03.01)
Mar 6, 2023	1.14% (0.01136)	59.45th	v2 (v2022.01.01)
Oct 18, 2022	1.14% (0.01136)	58.28th	v2 (v2022.01.01)
Apr 1, 2022	1.14% (0.01136)	56.27th	v2 (v2022.01.01)
Feb 4, 2022	1.14% (0.01136)	34.23th	v2 (v2022.01.01)
Feb 3, 2022	1.05% (0.01046)	28.66th	v1
Jan 6, 2022	1.05% (0.01046)	28.03th	v1
Sep 1, 2021	1.05% (0.01046)	65.02th	v1
Apr 14, 2021	1.05% (0.01046)	0.00th	v1

Weaknesses (2)

CWE-255

CWE-287

Improper Authentication

References (3)

http://www.securityfocus.com/bid/104434
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041082
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-password-reset
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/104434		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041082		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-password-reset		x_refsource_CONFIRMVendor Advisory