CVE-2023-20250
published 2023-09-06CVE-2023-20250: A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote…
PriorityP349high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
0.77%
52.0th percentile
A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device.
This vulnerability is due to improper validation of requests that are sent to the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary code with root privileges on an affected device. To exploit this vulnerability, the attacker must have valid Administrator credentials on the affected device.
Affected
211 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
vendor_cisco6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Stack Overflow Vulnerability
vendor_cisco·2023-09-06·CVSS 6.5
CVE-2023-20250 [MEDIUM] CWE-121 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Stack Overflow Vulnerability
Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Stack Overflow Vulnerability
A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device.
This vulnerability is due to improper validation of requests that are sent to the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary code with root privileges on an affected device. To exploit this vulnerability, the attacker must have valid Administrator credentials on the affected device.
There are no workarounds that address
Cisco
Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Stack Overflow Vulnerability
vendor_cisco·CVSS 3.1
CVE-2023-20250 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Stack Overflow Vulnerability
CVE-2023-20250: Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Stack Overflow Vulnerability
A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of requests that are sent to the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary code with root privileges on an affected device. To exploit this vulnerability, the attacker must have valid Administrator credentials on the affected device. There are no
CVSS: 3.1
C
GHSA
GHSA-5p9g-w9p4-jfm4: A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated,
ghsa_unreviewed·2023-09-06
CVE-2023-20250 [HIGH] CWE-121 GHSA-5p9g-w9p4-jfm4: A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated,
A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device.
This vulnerability is due to improper validation of requests that are sent to the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary code with root privileges on an affected device. To exploit this vulnerability, the attacker must have valid Administrator credentials on the affected device.
No detection rules found.
No public exploits indexed.
2023-09-06
Published