PT-2018-2137 · Cisco · Cisco Rv180W Wireless-N Multifunction Vpn Router+1

Published 2018-08-07 · Updated 2019-10-09 · CVE-2018-0405

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco RV180W Wireless-N Multifunction VPN Router and Small Business RV Series RV220W Wireless Network Security Firewall (affected versions not specified)

Description A vulnerability in the web framework code could allow an unauthenticated, remote attacker to conduct a directory path traversal attack on a targeted device. The issue is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location, potentially allowing them to disclose or modify protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2019-00089

CVE-2018-0405

Affected Products

Cisco Rv Series Rv220W Wireless Network Security Firewall

Cisco Rv180W Wireless-N Multifunction Vpn Router

References · 5

• https://bdu.fstec.ru/vul/2019-00089 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-0405 · Security Note
• https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk28019 · Vendor Advisory
• https://cxsecurity.com/cveshow/CVE-2018-0405 · Note
• https://quickview.cloudapps.cisco.com/quickview/bug/CSCvk28019 · Note