CVE-2018-0127
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A vulnerability in the web interface of Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote attacker to view configuration parameters for an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to the absence of user authentication requirements for certain pages that are part of the web interface and contain confidential information for an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device and examining the HTTP response to the request. A successful exploit could allow the attacker to view configuration parameters, including the administrator password, for the affected device. Cisco Bug IDs: CSCvg92739, CSCvh60172.
Una vulnerabilidad en la interfaz web de routers Cisco RV132W ADSL2+ Wireless-N VPN Routers y Cisco RV134W VDSL2 Wireless-AC VPN podría permitir que un atacante remoto no autenticado vea parámetros de configuración para un dispositivo afectado, lo que podría desembocar en la revelación de información confidencial. La vulnerabilidad se debe a la falta de requisitos para la autenticación de usuarios en ciertas páginas que forman parte de la interfaz web y contienen información confidencial para un dispositivo afectado. Un atacante podría explotar esta vulnerabilidad enviando una petición HTTP manipulada a un dispositivo afectado y examinando su respuesta HTTP. Un exploit con éxito podría permitir que el atacante vea parámetros de configuración, incluyendo la contraseña de administrador, en el dispositivo afectado. Cisco Bug IDs: CSCvg92739, CSCvh60172.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-11-27 CVE Reserved
- 2018-02-08 CVE Published
- 2023-09-04 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-306: Missing Authentication for Critical Function
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/102969 | Third Party Advisory | |
| http://www.securitytracker.com/id/1040345 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-rv13x_2 | 2020-09-04 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Cisco Search vendor "Cisco" | Rv132w Firmware Search vendor "Cisco" for product "Rv132w Firmware" | 1.0.0.1 Search vendor "Cisco" for product "Rv132w Firmware" and version "1.0.0.1" | - |
Affected
| in | Cisco Search vendor "Cisco" | Rv132w Search vendor "Cisco" for product "Rv132w" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Rv132w Firmware Search vendor "Cisco" for product "Rv132w Firmware" | 1.0.1.8 Search vendor "Cisco" for product "Rv132w Firmware" and version "1.0.1.8" | - |
Affected
| in | Cisco Search vendor "Cisco" | Rv132w Search vendor "Cisco" for product "Rv132w" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Rv134w Firmware Search vendor "Cisco" for product "Rv134w Firmware" | 1.0.0.1 Search vendor "Cisco" for product "Rv134w Firmware" and version "1.0.0.1" | - |
Affected
| in | Cisco Search vendor "Cisco" | Rv134w Search vendor "Cisco" for product "Rv134w" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Rv134w Firmware Search vendor "Cisco" for product "Rv134w Firmware" | 1.0.1.8 Search vendor "Cisco" for product "Rv134w Firmware" and version "1.0.1.8" | - |
Affected
| in | Cisco Search vendor "Cisco" | Rv134w Search vendor "Cisco" for product "Rv134w" | - | - |
Safe
|