PT-2011-4816 · Cisco · Srp521W+5

Published 2011-11-03 · Updated 2017-08-29 · CVE-2011-4005

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Small Business SRP521W, SRP526W, and SRP527W versions prior to 1.1.24 Cisco Small Business SRP541W, SRP546W, and SRP547W versions prior to 1.2.1

Description A cross-site request forgery (CSRF) issue exists in the Services Ready Platform Configuration Utility web interface, allowing remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands.

Recommendations For Cisco Small Business SRP521W, SRP526W, and SRP527W, update the firmware to version 1.1.24 or later. For Cisco Small Business SRP541W, SRP546W, and SRP547W, update the firmware to version 1.2.1 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2011-4005

Affected Products

Srp521W

Srp526W

Srp527W

Srp541W

Srp546W

Srp547W

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2011-4005 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111102-srp500 · Vendor Advisory
• http://secunia.com/advisories/46664 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71103 · Note
• http://securityfocus.com/bid/50495 · Note
• http://securitytracker.com/id?1026266 · Note