Executive Summary
Summary | |
---|---|
Title | Cisco RV110W, RV130W, and RV215W Routers Arbitrary Code Execution Vulnerability |
Informations | |||
---|---|---|---|
Name | cisco-sa-20160615-rv | First vendor Publication | 2016-06-15 |
Vendor | Cisco | Last vendor Modification | 2016-06-15 |
Severity (Vendor) | N/A | Revision | 1.0 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 10 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
A vulnerability in the web interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and the Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to execute arbitrary code as root on a targeted system. The vulnerability is due to insufficient sanitization of HTTP user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request with custom user data. An exploit could allow the attacker to execute arbitrary code with root-level privileges on the affected system, which could be leveraged to conduct further attacks. Cisco has not released software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160615-rv BEGIN PGP SIGNATURE Version: GnuPG v1.4.5 (SunOS) iQIVAwUBV1iuka89gD3EAJB5AQJHig/6A8c0ghf49Ku0Z3nkuRKv0V1jrahBY6uX RemK4SgHfPqUjeSaM9ci2RuCqFe1BeDOK9GBM3P6Mw0Tq5SpMndGD46P4Ha0hgL/ WuJsiwaPkOFKFS47pIKdX0k97RX9AWlHjYoB9XIXb19M+449rHi0Cz90b3Wk1w60 rXYtVtbqdiL5WVn/HmYA95EzwZ4HozVZvDIAzKkUy+mjOkTSHR38gpLSoCibB+3l I6U2Txc2crjnaUxupTRs9IG+hcDvNCaLb8C/ojSrXpQQGV3Q9XEXE9x/EZMLFl9x aQkJRiKT8aGAZfqqvP9JxuECXSTm2koYR2sgaI0yJWmpp068j0dA6zdc/zn/nM7N Rx27U1yWFH0qbFn8q65BbS/IOw+u1aV/LtmieWxuySHW0/BlVPEJyFXRZaS+rSfF Ted/NRe9e4XGd6Bn98S9+8vXXrvcaWcrxrl3aLy+lDstbl07EOC+eLd+YvzRrxbj s3uKiliQpryCkSC49SaY0zmj11KMpB0psLeUKPhJWzpa7LJpSRZtTbDyCjMrtspw mwobTZB+V8cVayhrPwGIyUN0ImfGg3DH1vlNoaUoXD8Wcj0T9dhWBkwx0dH/Oxol pSsR95Pi3p2e5xS47+7b1l1ViR0eTBTeCT+4bHMfPoDcp8msEJ/sSxpwZgiPAdjv 53TxLvrILWg= =2XbL END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com |
Original Source
Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...) |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-20 | Improper Input Validation |
CPE : Common Platform Enumeration
Snort® IPS/IDS
Date | Description |
---|---|
2016-06-17 | Cisco RV Series Routers command injection attempt RuleID : 39303 - Revision : 1 - Type : SERVER-WEBAPP |
Alert History
Date | Informations |
---|---|
2016-06-21 17:36:17 |
|
2016-06-15 21:26:14 |
|