PT-2016-2602 · Cisco · Cisco Rv215W+2

Rysh · Published 2016-08-08 · Updated 2018-12-15 · CVE-2015-6396

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco RV110W version not specified Cisco RV130W version not specified Cisco RV215W version not specified

Description The issue allows local users to execute arbitrary shell commands as an administrator via crafted parameters. This is due to the failure to neutralize special elements used in the operating system command.

Recommendations For Cisco RV110W, update to a version that fixes the issue. For Cisco RV130W, update to a version that fixes the issue. For Cisco RV215W, update to a version that fixes the issue.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2016-01994

CVE-2015-6396

Affected Products

Cisco Rv110W

Cisco Rv130W

Cisco Rv215W

References · 6

• 🔥 https://exploit-db.com/exploits/45986 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-6396 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160803-rv110_130w1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01994 · Security Note
• http://securityfocus.com/bid/92269 · Note
• http://securitytracker.com/id/1036528 · Note