PT-2016-4821 · Cisco · Cisco Small Business 220

Published 2016-09-02 · Updated 2017-08-13 · CVE-2016-1473

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Small Business 220 devices with firmware before 1.0.1.1

Description The issue concerns a hardcoded SNMP community in the affected devices, allowing remote attackers to read or modify SNMP objects by leveraging knowledge of this community.

Recommendations For Cisco Small Business 220 devices with firmware before 1.0.1.1, update the firmware to version 1.0.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to SNMP to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-1473

Affected Products

Cisco Small Business 220

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-1473 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-sps3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-1473 · Vendor Advisory
• http://synacktiv.com/ressources/advisories_cisco_switch_sg220_default_snmp.pdf · Note
• http://securitytracker.com/id/1036711 · Note
• http://securityfocus.com/bid/92710 · Note