PT-2016-2601 · Cisco · Cisco Rv215W+2

Published 2016-08-08 · Updated 2017-08-16 · CVE-2015-6397

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco RV110W, RV130W, and RV215W devices (affected versions not specified)

Description The issue is related to an incorrect Role-Based Access Control (RBAC) configuration for the default account in the affected devices. This configuration flaw allows remote authenticated users to gain root access via a login session with the default account.

Recommendations For Cisco RV110W, RV130W, and RV215W devices, consider restricting access to the default account until a proper fix is applied. As a temporary workaround, limit the privileges of the default account to prevent root access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2016-01993

CVE-2015-6397

Affected Products

Cisco Rv110W

Cisco Rv130W

Cisco Rv215W

References · 5

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160803-rv110_130w2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-6397 · Security Note
• https://bdu.fstec.ru/vul/2016-01993 · Security Note
• http://securityfocus.com/bid/92273 · Note
• http://securitytracker.com/id/1036524 · Note