PT-2016-4818 · Cisco · Cisco Small Business 220

Published 2016-09-02 · Updated 2017-08-13 · CVE-2016-1470

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Small Business 220 devices with firmware before 1.0.1.1

Description A cross-site request forgery (CSRF) issue exists in the web-based management interface, allowing remote attackers to hijack the authentication of arbitrary users.

Recommendations For versions before 1.0.1.1, update the firmware to version 1.0.1.1 or later to resolve the issue.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2016-1470

Affected Products

Cisco Small Business 220

References · 6

• 🔥 http://synacktiv.com/ressources/advisories_cisco_switch_sg220_csrf.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2016-1470 · Vendor Advisory
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-sps · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1470 · Security Note
• http://securitytracker.com/id/1036722 · Note
• http://securityfocus.com/bid/92709 · Note