CVSS: 9.0EPSS: 0%CPEs: 8EXPL: 0CVE-2020-3268 – Cisco Small Business RV110W, RV130, RV130W, and RV215W Series Routers Management Interface Vulnerabilities
https://notcve.org/view.php?id=CVE-2020-3268
Multiple vulnerabilities in the web-based management interface of Cisco RV110W, RV130, RV130W, and RV215W Series Routers could allow an authenticated, remote attacker with administrative privileges to execute arbitrary commands. For more information about these vulnerabilities, see the Details section of this advisory. Múltiples vulnerabilidades en la interfaz de administración basada en web de Routers Cisco RV110W, RV130, RV130W, y RV215W Series, podrían permitir a un atacante remoto autenticado con privilegios administrativos ejecutar comandos arbitrarios. Para más información sobre estas vulnerabilidades, consulte la sección Detalles de este aviso • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-routers-injection-tWC7krKQ • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 1CVE-2019-1899 – Cisco RV110W, RV130W, and RV215W Routers Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2019-1899
A vulnerability in the web interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to acquire the list of devices that are connected to the guest network. The vulnerability is due to improper authorization of an HTTP request. An attacker could exploit this vulnerability by accessing a specific URI on the web interface of the router. Una vulnerabilidad en la interfaz web de los enrutadores RV110W, RV130W y RV215W de Cisco, podría permitir que un atacante remoto no autenticado adquiera la lista de dispositivos que están conectados en la red de invitado. Una vulnerabilidad es debido a la autorización inapropiada de una petición HTTP. • http://www.securityfocus.com/bid/108867 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-rv-infodis https://www.tenable.com/security/research/tra-2019-29 • CWE-285: Improper Authorization CWE-425: Direct Request ('Forced Browsing') •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 1CVE-2019-1897 – Cisco RV110W, RV130W, and RV215W Routers Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2019-1897
A vulnerability in the web-based management interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to disconnect clients that are connected to the guest network on an affected router. The vulnerability is due to improper authorization of an HTTP request. An attacker could exploit this vulnerability by accessing the URL for device disconnection and providing the connected device information. A successful exploit could allow the attacker to deny service to specific clients that are connected to the guest network. Una vulnerabilidad en la interfaz de administración basada en web de los enrutadores RV110W, RV130W y RV215W de Cisco, podría permitir a un atacante remoto no autenticado desconectar a los clientes que están conectados a la red de invitado en un enrutador afectado. • http://www.securityfocus.com/bid/108848 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-rv-dos https://www.tenable.com/security/research/tra-2019-29 • CWE-285: Improper Authorization CWE-306: Missing Authentication for Critical Function •
CVSS: 5.3EPSS: 3%CPEs: 6EXPL: 1CVE-2019-1898 – Cisco RV110W, RV130W, and RV215W Routers Unauthenticated syslog File Access Vulnerability
https://notcve.org/view.php?id=CVE-2019-1898
A vulnerability in the web-based management interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to access the syslog file on an affected device. The vulnerability is due to improper authorization of an HTTP request. An attacker could exploit this vulnerability by accessing the URL for the syslog file. A successful exploit could allow the attacker to access the information contained in the file. Una vulnerabilidad en la interfaz de administración basada en web de los enrutadores RV110W, RV130W y RV215W de Cisco, podría permitir que un atacante remoto no autenticado acceda al archivo syslog en un dispositivo afectado. • http://www.securityfocus.com/bid/108865 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-rv-fileaccess https://www.tenable.com/security/research/tra-2019-29 • CWE-285: Improper Authorization CWE-425: Direct Request ('Forced Browsing') •
CVSS: 8.6EPSS: 0%CPEs: 6EXPL: 0CVE-2019-1843 – Cisco RV110W, RV130W, and RV215W Routers Management Interface Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2019-1843
A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition. This vulnerability is due to improper validation of user-supplied data in the web-based management interface. An attacker could exploit this vulnerability by sending malicious HTTP requests to a targeted device. A successful exploit could allow the attacker to reload the device and causing a DoS condition. Una vulnerabilidad en la interfaz de administración basada en web de los enrutadores RV110W Wireless-N VPN Firewall, RV130W Wireless-N Multifunction VPN, and RV215W Wireless-N VPN de Cisco, podría permitir que un atacante remoto no autenticado causara una recarga de un dispositivo afectado, resultando en una condición de denegación de servicio (DoS). • http://www.securityfocus.com/bid/108864 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-rvrouters-dos • CWE-20: Improper Input Validation •