CVSS: 9.0EPSS: 0%CPEs: 6EXPL: 0CVE-2018-0424 – Cisco RV110W, RV130W, and RV215W Routers Management Interface Command Injection Vulnerability
https://notcve.org/view.php?id=CVE-2018-0424
A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an authenticated, remote attacker to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input to scripts by the web-based management interface. An attacker could exploit this vulnerability by sending malicious requests to a targeted device. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the root user. Una vulnerabilidad en la interfaz de gestión web de los dispositivos Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router y Cisco RV215W Wireless-N VPN Router podrían permitir que un atacante remoto autenticado ejecute comandos arbitrarios. • http://www.securitytracker.com/id/1041677 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-rv-routers-injection • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2018-0425 – Cisco RV110W, RV130W, and RV215W Routers Management Interface Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2018-0425
A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper access control to files within the web-based management interface. An attacker could exploit this vulnerability by sending malicious requests to a targeted device. A successful exploit could allow the attacker to gain access to sensitive configuration information, including user authentication credentials. Una vulnerabilidad en la interfaz de gestión web de los dispositivos Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router y Cisco RV215W Wireless-N VPN Router podría permitir que un atacante remoto no autenticado obtenga información sensible. • http://www.securitytracker.com/id/1041676 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-rv-routers-disclosure • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-269: Improper Privilege Management •
CVSS: 6.8EPSS: 0%CPEs: 15EXPL: 0CVE-2016-1398
https://notcve.org/view.php?id=CVE-2016-1398
Buffer overflow in the web-based management interface on Cisco RV110W devices with firmware through 1.2.1.4, RV130W devices with firmware through 1.0.2.7, and RV215W devices with firmware through 1.3.0.7 allows remote authenticated users to cause a denial of service (device reload) via a crafted HTTP request, aka Bug ID CSCux86669. Desbordamiento de buffer en la interfaz de gestión basada en web en dispositivos Cisco RV110W con firmware hasta la versión 1.2.1.4, dispositivos RV130W con firmware hasta la versión 1.0.2.7 y dispositivos RV215W con firmware hasta la versión 1.3.0.7 permite a usuarios remotos autenticados causar una denegación de servicio (reinicio del dispositivo) a través de una petición HTTP manipulada, también conocido como Bug ID CSCux86669. • http://www.securitytracker.com/id/1036115 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160615-rv3 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 0%CPEs: 15EXPL: 0CVE-2016-1397
https://notcve.org/view.php?id=CVE-2016-1397
Buffer overflow in the web-based management interface on Cisco RV110W devices with firmware before 1.2.1.7, RV130W devices with firmware before 1.0.3.16, and RV215W devices with firmware before 1.3.0.8 allows remote authenticated users to cause a denial of service (device reload) via crafted configuration commands in an HTTP request, aka Bug ID CSCux82523. Desbordamiento de buffer en la interfaz de gestión basada en web en dispositivos Cisco RV110W con firmware en versiones anteriores a 1.2.1.7, dispositivos RV130W con firmware en versiones anteriores a 1.0.3.16 y dispositivos RV215W con firmware en versiones anteriores a 1.3.0.8 permite a usuarios remotos autenticados provocar una denegación de servicio (recarga del dispositivo) a través de comandos de configuración manipulados en una petición HTTP, también conocido como Bug ID CSCux82523. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160615-rv2 http://www.securitytracker.com/id/1036115 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.1EPSS: 0%CPEs: 15EXPL: 0CVE-2016-1396
https://notcve.org/view.php?id=CVE-2016-1396
Cross-site scripting (XSS) vulnerability in the web-based management interface on Cisco RV110W devices with firmware before 1.2.1.7, RV130W devices with firmware before 1.0.3.16, and RV215W devices with firmware before 1.3.0.8 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug ID CSCux82583. Vulnerabilidad de XSS en la interfaz de gestión basada en web en dispositivos Cisco RV110W con firmware before 1.2.1.7, dispositivos RV130W con firmware en versiones anteriores a 1.0.3.16 y dispositivos RV215W con firmware en versiones anteriores a 1.3.0.8 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de un parámetro manipulado, también conocido como Bug ID CSCux82583. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160615-rv1 http://www.securitytracker.com/id/1036114 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •