CVE-2019-15993
published 2020-09-23CVE-2019-15993: A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information. The…
PriorityP347medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EXPLOIT
EPSS
10.27%
95.2th percentile
A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information. The vulnerability exists because the software lacks proper authentication controls to information accessible from the web UI. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web UI of an affected device. A successful exploit could allow the attacker to access sensitive device information, which includes configuration files.
Affected
116 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_small_business_250_series_smart_switches_software | — | — |
| cisco | sf200-24_firmware | < 1.4.11.4 | 1.4.11.4 |
| cisco | sf200-24fp_firmware | < 1.4.11.4 | 1.4.11.4 |
| cisco | sf200-24p_firmware | < 1.4.11.4 | 1.4.11.4 |
| cisco | sf200-48_firmware | < 1.4.11.4 | 1.4.11.4 |
| cisco | sf200-48p_firmware | < 1.4.11.4 | 1.4.11.4 |
| cisco | sf250-24_firmware | < 2.5.0.92 | 2.5.0.92 |
| cisco | sf250-24p_firmware | < 2.5.0.92 | 2.5.0.92 |
| cisco | sf250-48_firmware | < 2.5.0.92 | 2.5.0.92 |
| cisco | sf250-48hp_firmware | < 2.5.0.92 | 2.5.0.92 |
| cisco | sf300-08_firmware | < 1.4.11.4 | 1.4.11.4 |
| cisco | sf300-24_firmware | < 1.4.11.4 | 1.4.11.4 |
| cisco | sf300-24mp_firmware | < 1.4.11.4 | 1.4.11.4 |
| cisco | sf300-24p_firmware | < 1.4.11.4 | 1.4.11.4 |
| cisco | sf300-24pp_firmware | < 1.4.11.4 | 1.4.11.4 |
| cisco | sf300-48_firmware | < 1.4.11.4 | 1.4.11.4 |
| cisco | sf300-48p_firmware | < 1.4.11.4 | 1.4.11.4 |
| cisco | sf300-48pp_firmware | < 1.4.11.4 | 1.4.11.4 |
| cisco | sf302-08_firmware | < 1.4.11.4 | 1.4.11.4 |
| cisco | sf302-08mp_firmware | < 1.4.11.4 | 1.4.11.4 |
| cisco | sf302-08mpp_firmware | < 1.4.11.4 | 1.4.11.4 |
| cisco | sf302-08p_firmware | < 1.4.11.4 | 1.4.11.4 |
| cisco | sf302-08pp_firmware | < 1.4.11.4 | 1.4.11.4 |
| cisco | sf350-48_firmware | < 2.5.0.92 | 2.5.0.92 |
| cisco | sf350-48mp_firmware | < 2.5.0.92 | 2.5.0.92 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_cisco7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-72qf-gj46-vcj3: A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information
ghsa_unreviewed·2022-05-24
CVE-2019-15993 [MEDIUM] CWE-287 GHSA-72qf-gj46-vcj3: A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information
A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information. The vulnerability exists because the software lacks proper authentication controls to information accessible from the web UI. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web UI of an affected device. A successful exploit could allow the attacker to access sensitive device information, which includes configuration files.
Cisco
Cisco Small Business Switches Information Disclosure Vulnerability
vendor_cisco·2020-01-29·CVSS 7.5
CVE-2019-15993 [HIGH] CWE-287 Cisco Small Business Switches Information Disclosure Vulnerability
Cisco Small Business Switches Information Disclosure Vulnerability
A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information.
The vulnerability exists because the software lacks proper authentication controls to information accessible from the web UI. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web UI of an affected device. A successful exploit could allow the attacker to access sensitive device information, which includes configuration files.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:https://sec.cloudapps.cisco.com/securi
Cisco
Cisco Small Business Switches Information Disclosure Vulnerability
vendor_cisco·CVSS 3.0
CVE-2019-15993 Cisco Small Business Switches Information Disclosure Vulnerability
CVE-2019-15993: Cisco Small Business Switches Information Disclosure Vulnerability
A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information. The vulnerability exists because the software lacks proper authentication controls to information accessible from the web UI. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web UI of an affected device. A successful exploit could allow the attacker to access sensitive device information, which includes configuration files. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.0
CWE: CWE-287, CWE-287
Bug IDs: CSCvr54104, CSCvs68748
No detection rules found.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/171723/Cisco-Dell-Netgear-Information-Disclosure-Hash-Decrypter.htmlhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200129-smlbus-switch-discloshttp://packetstormsecurity.com/files/171723/Cisco-Dell-Netgear-Information-Disclosure-Hash-Decrypter.htmlhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200129-smlbus-switch-disclos
2020-09-23
Published