PT-2019-3592 · Cisco · Cisco Small Business Switches

Marcin Mol · Published 2019-10-16 · Updated 2020-09-01 · CVE-2019-12636

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Small Business Switches versions (affected versions not specified)

Description The issue is related to a lack of protection against cross-site request forgery (CSRF) attacks in the web-based management interface. This could allow a remote attacker to modify the device configuration or cause a denial of service (DoS) condition by persuading a user to follow a malicious link. The attacker could perform arbitrary actions with the privilege level of the targeted user, potentially altering the configuration, executing commands, or causing a DoS condition if the user has administrative privileges.

Recommendations For all affected versions, consider disabling access to the web-based management interface until a patch is available. Restrict access to the management interface to minimize the risk of exploitation. Avoid using the interface for critical operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2019-03801

CVE-2019-12636

Affected Products

Cisco Small Business Switches

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-sbss-csrf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-12636 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03801 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-12636 · Security Note