PT-2017-17191 · Cisco · Cvr100W Wireless-N Vpn Router

Published 2017-05-03 · Updated 2019-10-03 · CVE-2017-6620

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco CVR100W Wireless-N VPN Router versions prior to 1.0.1.24

Description A vulnerability in the remote management access control list (ACL) feature could allow an unauthenticated, remote attacker to bypass the remote management ACL. This is due to incorrect implementation of the ACL decision made during the ingress connection request to the remote management interface. An attacker could exploit this by sending a connection to the management IP address or domain name of the targeted device, potentially allowing them to bypass the configured remote management ACL. This issue can occur even when the Remote Management configuration parameter is set to Disabled.

Recommendations For Cisco CVR100W Wireless-N VPN Router versions prior to 1.0.1.24, update the firmware to version 1.0.1.24 or later to resolve the issue. As a temporary workaround, consider restricting access to the remote management interface until the update can be applied.

Fix

RCE

Weakness Enumeration

CWE-20

CWE-264

Related Identifiers

CVE-2017-6620

Affected Products

Cvr100W Wireless-N Vpn Router

References · 5

• https://osv.dev/vulnerability/CVE-2017-6620 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170503-cvr100w2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6620 · Security Note
• http://securitytracker.com/id/1038395 · Note
• http://securityfocus.com/bid/98289 · Note