PT-2019-2898 · Cisco · Cisco Small Business 220 Series Smart Switches
Bashis
·
Publicado
2019-08-06
·
Atualizado
2020-10-16
·
CVE-2019-1912
CVSS v3.1
10
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Cisco Small Business 220 Series Smart Switches versions prior to 1.1.4.4
Description
A vulnerability in the web management interface could allow an unauthenticated, remote attacker to upload arbitrary files due to incomplete authorization checks. An attacker could exploit this by sending a malicious request to certain parts of the web management interface, potentially via HTTP or HTTPS, depending on the switch's configuration. A successful exploit could allow the attacker to modify the device's configuration or inject a reverse shell.
Recommendations
For versions prior to 1.1.4.4, update the firmware to version 1.1.4.4 or later to resolve the issue. As a temporary workaround, consider disabling the web management interface until a patch is available. Restrict access to the web management interface to minimize the risk of exploitation. Avoid using the web management interface via HTTP or HTTPS until the issue is resolved.
Exploit
Correção
Incorrect Authorization
Improper Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Cisco Small Business 220 Series Smart Switches