9

CVE-2014-2177

The network-diagnostics administration interface in the Cisco RV router firmware on RV220W devices, before 1.0.5.9 on RV120W devices, and before 1.0.4.14 on RV180 and RV180W devices allows remote authenticated users to execute arbitrary commands via a crafted HTTP request, aka Bug ID CSCuh87126.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Rv120w Firmware Version <= 1.0.5.8
Cisco ≫ Rv120w Version -
Cisco ≫ Rv220w Firmware Version <= 1.0.5.8
Cisco ≫ Rv220w Version -
Cisco ≫ Rv180 Firmware Version <= 1.0.3.10
Cisco ≫ Rv180 Version -
Cisco ≫ Rv180w Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.58% 0.832
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9 8 10
AV:N/AC:L/Au:S/C:C/I:C/A:C
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

http://packetstormsecurity.com/files/128992/Cisco-RV-Overwrite-CSRF-Command-Execution.html
http://seclists.org/fulldisclosure/2014/Nov/6
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141105-rv
Patch
Vendor Advisory
http://www.securityfocus.com/archive/1/533917/100/0/threaded
http://www.securitytracker.com/id/1031171
https://exchange.xforce.ibmcloud.com/vulnerabilities/98497