PT-2019-2901 · Cisco · Cisco Small Business 220 Series Smart Switches

Published 2019-08-06 · Updated 2019-10-01 · CVE-2019-1914

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Small Business 220 Series Smart Switches (affected versions not specified)

Description The issue is related to a command injection attack in the web management interface of the affected switches. This is due to insufficient validation of user-supplied input, allowing an attacker to execute arbitrary shell commands with root privileges. The attack requires a valid login session with a privilege level 15 user and can be performed by sending a malicious HTTP or HTTPS request, depending on the device's configuration.

Recommendations For Cisco Small Business 220 Series Smart Switches, consider restricting access to the web management interface until a fix is available. As a temporary workaround, limit the privileges of users who have access to the web management interface to minimize the risk of exploitation. Avoid using the web management interface for critical operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2019-02870

CVE-2019-1914

Affected Products

Cisco Small Business 220 Series Smart Switches

References · 6

• 🔥 https://exploit-db.com/exploits/47442 · Exploit
• https://bdu.fstec.ru/vul/2019-02870 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1914 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190806-sb220-inject · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1914 · Security Note
• http://packetstormsecurity.com/files/154667/Realtek-Managed-Switch-Controller-RTL83xx-Stack-Overflow.html · Note