9

CVE-2019-15271

Warnung
A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web-based management interface of the targeted device. A successful exploit could allow the attacker to execute commands with root privileges.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Rv016 Multi-wan Vpn Firmware Version < 4.2.3.10
   Cisco ≫ Rv016 Multi-wan Vpn Version-
Cisco ≫ Rv042 Dual Wan Vpn Firmware Version < 4.2.3.10
   Cisco ≫ Rv042 Dual Wan Vpn Version-
Cisco ≫ Rv082 Dual Wan Vpn Firmware Version < 4.2.3.10
   Cisco ≫ Rv082 Dual Wan Vpn Version-

08.06.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability

Schwachstelle

A deserialization of untrusted data vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an attacker to execute code with root privileges.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 5.88% 0.902
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 9 8 10
AV:N/AC:L/Au:S/C:C/I:C/A:C
psirt@cisco.com 8.8 2.8 5.9
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.