PT-2018-1698 · Cisco · Cisco Rv215W Wireless-N Vpn Router+2
Publicado
2018-09-05
·
Atualizado
2019-10-09
·
CVE-2018-0426
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Cisco RV110W Wireless-N VPN Firewall versions (affected versions not specified)
Cisco RV130W Wireless-N Multifunction VPN Router versions (affected versions not specified)
Cisco RV215W Wireless-N VPN Router versions (affected versions not specified)
Description
The issue is caused by insufficient validation of directory traversal character sequences in the web-based management interface. This could allow a remote attacker to disclose sensitive information by sending specially crafted requests. The attacker may gain access to arbitrary files on the affected device, resulting in the disclosure of sensitive information.
Recommendations
For Cisco RV110W Wireless-N VPN Firewall, restrict access to the web-based management interface until a fix is available.
For Cisco RV130W Wireless-N Multifunction VPN Router, consider disabling the web-based management interface as a temporary workaround until a patch is available.
For Cisco RV215W Wireless-N VPN Router, avoid using the web-based management interface until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Information Disclosure
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Cisco Rv110W Wireless-N Vpn Firewall
Cisco Rv130W Wireless-N Multifunction Vpn Router
Cisco Rv215W Wireless-N Vpn Router