CVE-2016-1396
published 2016-06-19CVE-2016-1396: Cross-site scripting (XSS) vulnerability in the web-based management interface on Cisco RV110W devices with firmware before 1.2.1.7, RV130W devices with…
PriorityP425medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EPSS
1.01%
59.5th percentile
Cross-site scripting (XSS) vulnerability in the web-based management interface on Cisco RV110W devices with firmware before 1.2.1.7, RV130W devices with firmware before 1.0.3.16, and RV215W devices with firmware before 1.3.0.8 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug ID CSCux82583.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | rv110w_rv130w_and_rv215w_routers | — | — |
| cisco | rv110w_wireless-n_vpn_firewall_firmware | — | — |
| cisco | rv110w_wireless-n_vpn_firewall_firmware | — | — |
| cisco | rv110w_wireless-n_vpn_firewall_firmware | — | — |
| cisco | rv110w_wireless-n_vpn_firewall_firmware | — | — |
| cisco | rv130w_wireless-n_multifunction_vpn_router_firmware | — | — |
| cisco | rv130w_wireless-n_multifunction_vpn_router_firmware | — | — |
| cisco | rv130w_wireless-n_multifunction_vpn_router_firmware | — | — |
| cisco | rv215w_wireless-n_vpn_router_firmware | — | — |
| cisco | rv215w_wireless-n_vpn_router_firmware | — | — |
| cisco | rv215w_wireless-n_vpn_router_firmware | — | — |
| cisco | rv215w_wireless-n_vpn_router_firmware | — | — |
| cisco | rv215w_wireless-n_vpn_router_firmware | — | — |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_cisco4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco RV110W, RV130W, and RV215W Routers Cross-Site Scripting Vulnerability
vendor_cisco·2016-06-15·CVSS 4.3
CVE-2016-1396 [MEDIUM] CWE-79 Cisco RV110W, RV130W, and RV215W Routers Cross-Site Scripting Vulnerability
Cisco RV110W, RV130W, and RV215W Routers Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco RV110W Wireless-N VPN Firewalls, Cisco RV130W Wireless-N Multifunction VPN Routers, and Cisco RV215W Wireless-N VPN Routers could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface for a targeted device.
The vulnerability is due to improper input validation of certain parameters that are sent to an affected device via the HTTP GET or HTTP POST method. An unauthenticated, remote attacker could exploit this vulnerability by persuading a user to follow a link that is designed to submit malicious input to an affected device. A successful exploit could allow the atta
Cisco
Cisco RV110W, RV130W, and RV215W Routers Cross-Site Scripting Vulnerability
vendor_cisco
CVE-2016-1396 Cisco RV110W, RV130W, and RV215W Routers Cross-Site Scripting Vulnerability
CVE-2016-1396: Cisco RV110W, RV130W, and RV215W Routers Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco RV110W Wireless-N VPN Firewalls, Cisco RV130W Wireless-N Multifunction VPN Routers, and Cisco RV215W Wireless-N VPN Routers could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface for a targeted device. The vulnerability is due to improper input validation of certain parameters that are sent to an affected device via the HTTP GET or HTTP POST method. An unauthenticated, remote attacker could exploit this vulnerability by persuading a user to follow a link that is designed to submit malicious input to an affected device. A successful exploit could a
GHSA
GHSA-2359-9wr6-w9cg: Cross-site scripting (XSS) vulnerability in the web-based management interface on Cisco RV110W devices with firmware before 1
ghsa_unreviewed·2022-05-17
CVE-2016-1396 [MEDIUM] CWE-79 GHSA-2359-9wr6-w9cg: Cross-site scripting (XSS) vulnerability in the web-based management interface on Cisco RV110W devices with firmware before 1
Cross-site scripting (XSS) vulnerability in the web-based management interface on Cisco RV110W devices with firmware before 1.2.1.7, RV130W devices with firmware before 1.0.3.16, and RV215W devices with firmware before 1.3.0.8 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug ID CSCux82583.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2016-06-19
Published