PT-2018-2137 · Cisco · Cisco Rv180W Wireless-N Multifunction Vpn Router+1

Publicado 2018-08-07 · Atualizado 2019-10-09 · CVE-2018-0405

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco RV180W Wireless-N Multifunction VPN Router and Small Business RV Series RV220W Wireless Network Security Firewall (affected versions not specified)

Description A vulnerability in the web framework code could allow an unauthenticated, remote attacker to conduct a directory path traversal attack on a targeted device. The issue is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location, potentially allowing them to disclose or modify protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2019-00089

CVE-2018-0405

Produtos afetados

Cisco Rv Series Rv220W Wireless Network Security Firewall

Cisco Rv180W Wireless-N Multifunction Vpn Router

Referências · 5

• https://bdu.fstec.ru/vul/2019-00089 · Nota de Segurança
• https://cxsecurity.com/cveshow/CVE-2018-0405 · Nota
• https://quickview.cloudapps.cisco.com/quickview/bug/CSCvk28019 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-0405 · Nota de Segurança
• https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk28019 · Aviso do Fabricante