9

CVE-2019-15271

Warning

A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web-based management interface of the targeted device. A successful exploit could allow the attacker to execute commands with root privileges.

Data is provided by the National Vulnerability Database (NVD)
Cisco ≫ Rv016 Multi-wan Vpn Firmware Version < 4.2.3.10
   Cisco ≫ Rv016 Multi-wan Vpn Version-
Cisco ≫ Rv042 Dual Wan Vpn Firmware Version < 4.2.3.10
   Cisco ≫ Rv042 Dual Wan Vpn Version-
Cisco ≫ Rv082 Dual Wan Vpn Firmware Version < 4.2.3.10
   Cisco ≫ Rv082 Dual Wan Vpn Version-

08.06.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability

Vulnerability

A deserialization of untrusted data vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an attacker to execute code with root privileges.

Description

Apply updates per vendor instructions.

Required actions
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 9.84% 0.927
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 9 8 10
AV:N/AC:L/Au:S/C:C/I:C/A:C
psirt@cisco.com 8.8 2.8 5.9
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.