PT-2019-4234 · Cisco · Cisco Small Business Rv082+4

Published 2019-11-20 · Updated 2020-10-16 · CVE-2019-15990

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Small Business RV Series Routers (affected versions not specified) Cisco Small Business RV016 (affected versions not specified) Cisco Small Business RV042 (affected versions not specified) Cisco Small Business RV042G (affected versions not specified) Cisco Small Business RV082 (affected versions not specified)

Description A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an unauthenticated, remote attacker to view information displayed in the web-based management interface. The vulnerability is due to improper authorization of HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to view information displayed in the web-based management interface without authentication.

Recommendations For Cisco Small Business RV Series Routers, consider restricting access to the web-based management interface until a patch is available. For Cisco Small Business RV016, disable remote access to the web-based management interface as a temporary workaround. For Cisco Small Business RV042, restrict access to the web-based management interface to minimize the risk of exploitation. For Cisco Small Business RV042G, avoid using the web-based management interface for sensitive operations until the issue is resolved. For Cisco Small Business RV082, limit access to the web-based management interface to trusted users and networks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Incorrect Authorization

Weakness Enumeration

CWE-285

CWE-863

CWE-265

Related Identifiers

BDU:2019-04835

CVE-2019-15990

Affected Products

Cisco Small Business Rv Series Routers

Cisco Small Business Rv016

Cisco Small Business Rv042

Cisco Small Business Rv042G

Cisco Small Business Rv082

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191120-sbr-rv-infodis · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15990 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04835 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-15990 · Security Note