CVE-2020-3323
published 2020-07-16CVE-2020-3323: A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote…
PriorityP270critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
5.75%
92.2th percentile
A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The vulnerability is due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system of the affected device.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | rv110w_wireless-n_vpn_firewall_firmware | < 1.2.2.8 | 1.2.2.8 |
| cisco | rv130_vpn_router_firmware | < 1.0.3.54 | 1.0.3.54 |
| cisco | rv130w_wireless-n_multifunction_vpn_router_firmware | < 1.0.3.54 | 1.0.3.54 |
| cisco | rv215w_wireless-n_vpn_router_firmware | < 1.3.1.7 | 1.3.1.7 |
| cisco | small_business_rv110w_rv130_rv130w_and_rv215w_routers | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit vector is crafted HTTP requests sent to the web-based management interface of affected Cisco Small Business routers (RV110W, RV130, RV130W, RV215W); monitor for anomalous or malformed HTTP requests targeting the management interface from unauthenticated sources. ↗
- →Successful exploitation results in arbitrary code execution as root on the underlying OS; alert on unexpected root-level process spawning from the web management daemon on affected devices. ↗
- →The vulnerability is triggered via improper validation of user-supplied input in the web-based management interface; look for oversized or unexpected parameter values in HTTP POST/GET requests to the management interface. ↗
- ·No workarounds are available for this vulnerability; patching via Cisco-released software updates is the only remediation path. ↗
- ·Affected devices are Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers; scope detection rules accordingly to these specific product lines. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_cisco9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
vendor_cisco·2020-07-15·CVSS 9.8
CVE-2020-3323 [CRITICAL] CWE-119 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device.
The vulnerability is due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system of the affected device.
Cisco has released software updates that address this vulnerability. There are no workarounds that a
Cisco
Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
vendor_cisco·CVSS 3.0
CVE-2020-3323 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
CVE-2020-3323: Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The vulnerability is due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system of the affected device. Cisco has released software updates that address this vulnerability. There are no
CVSS:
GHSA
GHSA-rp99-4vgc-7q2h: A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated
ghsa_unreviewed·2022-05-24
CVE-2020-3323 [HIGH] CWE-20 GHSA-rp99-4vgc-7q2h: A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated
A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The vulnerability is due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system of the affected device.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-07-16
Published