CVSS: 5.3EPSS: 0%CPEs: 8EXPL: 0CVE-2019-15990 – Cisco Small Business Routers RV016, RV042, RV042G, and RV082 Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2019-15990
A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an unauthenticated, remote attacker to view information displayed in the web-based management interface. The vulnerability is due to improper authorization of HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to view information displayed in the web-based management interface without authentication. Una vulnerabilidad en la interfaz de administración basada en web de determinados Enrutadores Cisco Small Business RV Series, podría permitir a un atacante remoto no autenticado visualizar la información desplegada en la interfaz de administración basada en web. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191120-sbr-rv-infodis • CWE-285: Improper Authorization •
CVSS: 9.0EPSS: 0%CPEs: 8EXPL: 0CVE-2019-15271 – Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability
https://notcve.org/view.php?id=CVE-2019-15271
A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web-based management interface of the targeted device. A successful exploit could allow the attacker to execute commands with root privileges. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-sbrv-cmd-x • CWE-502: Deserialization of Untrusted Data •