PT-2020-1744 · Cisco · Cisco Small Business Switches

Published 2020-01-29 · Updated 2023-04-06 · CVE-2019-15993

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Small Business Switches versions 200, 250, 300, 350, 350X, 500, 550X

Description The issue is related to inadequate data processing in the web interface of the affected devices, which could allow a remote attacker to gain unauthorized access to sensitive information. The vulnerability exists due to a lack of proper authentication controls for information accessible through the web interface. An attacker could exploit this by sending a malicious HTTP request to the web UI of an affected device, potentially allowing access to sensitive device information, including configuration files.

Recommendations For Cisco Small Business Switches versions 200, 250, 300, 350, 350X, 500, 550X, consider disabling access to the web UI until a patch is available. Restrict access to the web UI to minimize the risk of exploitation. Avoid using the web UI for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

CWE-16

Related Identifiers

BDU:2020-00984

CVE-2019-15993

Affected Products

Cisco Small Business Switches

References · 7

• 🔥 https://exploit-db.com/exploits/51248 · Exploit
• https://osv.dev/vulnerability/CVE-2019-15993 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200129-smlbus-switch-disclos · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15993 · Security Note
• https://bdu.fstec.ru/vul/2020-00984 · Security Note
• https://t.me/cibsecurity/14835 · Telegram Post
• http://packetstormsecurity.com/files/171723/Cisco-Dell-Netgear-Information-Disclosure-Hash-Decrypter.html · Note