PT-2018-1698 · Cisco · Cisco Rv215W Wireless-N Vpn Router+2
Published
2018-09-05
·
Updated
2019-10-09
·
CVE-2018-0426
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Cisco RV110W Wireless-N VPN Firewall versions (affected versions not specified)
Cisco RV130W Wireless-N Multifunction VPN Router versions (affected versions not specified)
Cisco RV215W Wireless-N VPN Router versions (affected versions not specified)
Description
The issue is caused by insufficient validation of directory traversal character sequences in the web-based management interface. This could allow a remote attacker to disclose sensitive information by sending specially crafted requests. The attacker may gain access to arbitrary files on the affected device, resulting in the disclosure of sensitive information.
Recommendations
For Cisco RV110W Wireless-N VPN Firewall, restrict access to the web-based management interface until a fix is available.
For Cisco RV130W Wireless-N Multifunction VPN Router, consider disabling the web-based management interface as a temporary workaround until a patch is available.
For Cisco RV215W Wireless-N VPN Router, avoid using the web-based management interface until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Information Disclosure
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Cisco Rv110W Wireless-N Vpn Firewall
Cisco Rv130W Wireless-N Multifunction Vpn Router
Cisco Rv215W Wireless-N Vpn Router