PT-2020-3109 · Cisco · Cisco Small Business Rv130+3
Quentin Kaiser
·
Published
2020-07-15
·
Updated
2020-07-23
·
CVE-2020-3144
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Cisco Small Business RV110W versions not specified
Cisco Small Business RV130 versions not specified
Cisco Small Business RV130W versions not specified
Cisco Small Business RV215W versions not specified
Description
The issue is related to inadequate access control in the web-based management interface of the affected devices. It may allow a remote attacker to execute arbitrary commands with administrative privileges. The vulnerability is due to improper session management. An attacker could exploit this by sending a crafted HTTP request to the device. A successful exploit could allow the attacker to gain administrative access.
Recommendations
For Cisco Small Business RV110W, update the firmware to a version that addresses the improper session management issue.
For Cisco Small Business RV130, update the firmware to a version that addresses the improper session management issue.
For Cisco Small Business RV130W, update the firmware to a version that addresses the improper session management issue.
For Cisco Small Business RV215W, update the firmware to a version that addresses the improper session management issue.
As a temporary workaround, consider restricting access to the web-based management interface until a patch is available.
Fix
Improper Authentication
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Cisco Small Business Rv110W
Cisco Small Business Rv130
Cisco Small Business Rv130W
Cisco Small Business Rv215W