CVSS: 7.2EPSS: 0%CPEs: 286EXPL: 0CVE-2024-20263
https://notcve.org/view.php?id=CVE-2024-20263
26 Jan 2024 — A vulnerability with the access control list (ACL) management within a stacked switch configuration of Cisco Business 250 Series Smart Switches and Business 350 Series Managed Switches could allow an unauthenticated, remote attacker to bypass protection offered by a configured ACL on an affected device. This vulnerability is due to incorrect processing of ACLs on a stacked configuration when either the primary or backup switches experience a full stack reload or power cycle. An attacker could exploit this v... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-bus-acl-bypass-5zn9hNJk • CWE-284: Improper Access Control •
CVSS: 8.1EPSS: 0%CPEs: 418EXPL: 0CVE-2021-34739 – Cisco Small Business Series Switches Session Credentials Replay Vulnerability
https://notcve.org/view.php?id=CVE-2021-34739
04 Nov 2021 — A vulnerability in the web-based management interface of multiple Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to replay valid user session credentials and gain unauthorized access to the web-based management interface of an affected device. This vulnerability is due to insufficient expiration of session credentials. An attacker could exploit this vulnerability by conducting a man-in-the-middle attack against an affected device to intercept valid session credentials a... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-switches-tokens-UzwpR4e5 • CWE-613: Insufficient Session Expiration •
CVSS: 7.5EPSS: 11%CPEs: 258EXPL: 2CVE-2019-15993 – Cisco Small Business Switches Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2019-15993
23 Sep 2020 — A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information. The vulnerability exists because the software lacks proper authentication controls to information accessible from the web UI. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web UI of an affected device. A successful exploit could allow the attacker to access sensitive device information, which includes configuration fi... • https://packetstorm.news/files/id/171723 • CWE-16: Configuration CWE-287: Improper Authentication •
CVSS: 5.3EPSS: 0%CPEs: 228EXPL: 0CVE-2020-3496 – Cisco Small Business Smart and Managed Switches Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2020-3496
26 Aug 2020 — A vulnerability in the IPv6 packet processing engine of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient validation of incoming IPv6 traffic. An attacker could exploit this vulnerability by sending a crafted IPv6 packet through an affected device. A successful exploit could allow the attacker to cause the switch management CLI to stop responding, resulti... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sbss-ipv6-dos-tsgqbffW • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 5%CPEs: 236EXPL: 0CVE-2020-3297 – Cisco Small Business Smart and Managed Switches Session Management Vulnerability
https://notcve.org/view.php?id=CVE-2020-3297
02 Jul 2020 — A vulnerability in session management for the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to defeat authentication protections and gain unauthorized access to the management interface. The attacker could obtain the privileges of the highjacked session account, which could include administrator privileges on the device. The vulnerability is due to the use of weak entropy generation for session identifier values. An attacker could expl... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sbswitch-session-JZAS5jnY • CWE-287: Improper Authentication •
CVSS: 7.2EPSS: 0%CPEs: 228EXPL: 0CVE-2019-1859 – Cisco Small Business Switches Secure Shell Certificate Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2019-1859
03 May 2019 — A vulnerability in the Secure Shell (SSH) authentication process of Cisco Small Business Switches software could allow an attacker to bypass client-side certificate authentication and revert to password authentication. The vulnerability exists because OpenSSH mishandles the authentication process. An attacker could exploit this vulnerability by attempting to connect to the device via SSH. A successful exploit could allow the attacker to access the configuration as an administrative user if the default crede... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-scbv • CWE-285: Improper Authorization CWE-295: Improper Certificate Validation •