PT-2019-3962 · Cisco · Cisco Small Business Rv082+4
Michel Gaschet--Clousier
·
Published
2019-11-06
·
Updated
2022-06-08
·
CVE-2019-15271
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Cisco RV Series Routers (affected versions not specified)
Cisco Small Business RV016 (affected versions not specified)
Cisco Small Business RV042 (affected versions not specified)
Cisco Small Business RV042G (affected versions not specified)
Cisco Small Business RV082 (affected versions not specified)
Description
A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload, specifically deserialization of untrusted data. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web-based management interface of the targeted device. A successful exploit could allow the attacker to execute commands with root privileges.
Recommendations
For Cisco RV Series Routers, consider restricting access to the web-based management interface until a patch is available.
For Cisco Small Business RV016, RV042, RV042G, and RV082, restrict access to the web-based management interface to minimize the risk of exploitation.
As a temporary workaround, consider disabling remote management capabilities until a patch is available.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cisco Rv Series Routers
Cisco Small Business Rv016
Cisco Small Business Rv042
Cisco Small Business Rv042G
Cisco Small Business Rv082