CVE-2019-15990: A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an unauthenticated, remote attacker to view…

PriorityP431medium5.3CVSS 3.1

AVNACLPRNUINSUCLINAN

EPSS

1.20%

64.8th percentile

A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an unauthenticated, remote attacker to view information displayed in the web-based management interface. The vulnerability is due to improper authorization of HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to view information displayed in the web-based management interface without authentication.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
cisco	cisco_small_business_rv_series_router_firmware	>= unspecified < n/a	n/a
cisco	rv016_multi-wan_vpn_firmware	< 4.2.3.10	4.2.3.10
cisco	rv042_dual_wan_vpn_firmware	< 4.2.3.10	4.2.3.10
cisco	rv042g_dual_gigabit_wan_vpn_firmware	< 4.2.3.10	4.2.3.10
cisco	rv082_dual_wan_vpn_firmware	< 4.2.3.10	4.2.3.10
cisco	small_business_routers_rv016_rv042_rv042g_and_rv082	—	—

CVSS provenance

nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

vendor_cisco5.3MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.