PT-2019-2897 · Cisco · Cisco Small Business 220 Series

Published 2019-08-06 · Updated 2019-10-01 · CVE-2019-1913

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Small Business 220 Series (affected versions not specified)

Description The issue is related to errors in input validation and buffer overflow in the memory, allowing a remote attacker to potentially elevate privileges and execute arbitrary code by sending specially crafted HTTP or HTTPS requests, depending on the device's configuration. The vulnerabilities are due to insufficient validation of user-supplied input and improper boundary checks when reading data into an internal buffer.

Recommendations For Cisco Small Business 220 Series, consider restricting access to the web management interface until a fix is available. As a temporary workaround, avoid using the web management interface for administrative tasks until the issue is resolved. Restrict access to the device via HTTP or HTTPS to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Buffer Overflow

Weakness Enumeration

CWE-20

CWE-119

Related Identifiers

BDU:2019-02866

CVE-2019-1913

Affected Products

Cisco Small Business 220 Series

References · 6

• 🔥 https://exploit-db.com/exploits/47442 · Exploit
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190806-sb220-rce · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1913 · Security Note
• https://bdu.fstec.ru/vul/2019-02866 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1913 · Vendor Advisory
• http://packetstormsecurity.com/files/154667/Realtek-Managed-Switch-Controller-RTL83xx-Stack-Overflow.html · Note