PT-2020-3108 · Cisco · Cisco Small Business Rv130+3
Published
2020-07-15
·
Updated
2021-08-06
·
CVE-2020-3323
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Cisco Small Business RV110W versions (affected versions not specified)
Cisco Small Business RV130 versions (affected versions not specified)
Cisco Small Business RV130W versions (affected versions not specified)
Cisco Small Business RV215W versions (affected versions not specified)
Description
The issue is due to insufficient validation of user input in the web-based management interface, allowing a remote attacker to execute arbitrary code on the device. An attacker could exploit this by sending crafted HTTP requests to the targeted device, potentially allowing them to execute arbitrary code as the root user on the underlying operating system.
Recommendations
For Cisco Small Business RV110W, update to a version that fixes the improper validation of user-supplied input in the web-based management interface.
For Cisco Small Business RV130, update to a version that fixes the improper validation of user-supplied input in the web-based management interface.
For Cisco Small Business RV130W, update to a version that fixes the improper validation of user-supplied input in the web-based management interface.
For Cisco Small Business RV215W, update to a version that fixes the improper validation of user-supplied input in the web-based management interface.
As a temporary workaround, consider restricting access to the web-based management interface until a patch is available.
Fix
Buffer Overflow
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Cisco Small Business Rv110W
Cisco Small Business Rv130
Cisco Small Business Rv130W
Cisco Small Business Rv215W