PT-2014-4535 · Cisco · Cisco Rv120W+3

Published 2014-11-07 · Updated 2018-10-09 · CVE-2014-2178

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco RV router firmware versions prior to 1.0.5.9 on RV220W devices Cisco RV router firmware versions prior to 1.0.4.14 on RV180 and RV180W devices Cisco RV router firmware versions prior to 1.0.5.9 on RV120W devices

Description A cross-site request forgery (CSRF) issue exists in the administrative web interface of the Cisco RV router firmware, allowing remote attackers to hijack the authentication of administrators.

Recommendations For RV220W devices, update to version 1.0.5.9 or later to resolve the issue. For RV180 and RV180W devices, update to version 1.0.4.14 or later to resolve the issue. For RV120W devices, update to version 1.0.5.9 or later to resolve the issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2014-2178

Affected Products

Cisco Rv120W

Cisco Rv180

Cisco Rv180W

Cisco Rv220W

References · 7

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141105-rv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-2178 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98498 · Note
• http://securitytracker.com/id/1031171 · Note
• http://securityfocus.com/archive/1/533917/100/0/threaded · Note
• http://seclists.org/fulldisclosure/2014/Nov/6 · Note
• http://packetstormsecurity.com/files/128992/Cisco-RV-Overwrite-CSRF-Command-Execution.html · Note