// For flags

CVE-2019-5747

Cisco Device Hardcoded Credentials / GNU glibc / BusyBox

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

< 1%
*EPSS

Affected Versions

5
*CPE

Public Exploits

3
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679.

Se ha descubierto un problema en BusyBox hasta la versión 1.30.0. Una lectura fuera de límites en los componentes udhcp (consumidos por el cliente, el servidor y/o el relé DHCP) podría permitir a un atacante remoto filtrar información sensible de la pila enviando un mensaje DHCP manipulado. Esto está relacionado con el aseguramiento de una longitud de 4 bytes al decodificar DHCP_SUBNET. NOTA: este problema existe debido a una corrección incompleta de CVE-2018-20679

Many Cisco devices such as Cisco RV340, Cisco RV340W, Cisco RV345, Cisco RV345P, Cisco RV260, Cisco RV260P, Cisco RV260W, Cisco 160, and Cisco 160W suffer from having hard-coded credentials, known GNU glibc, known BusyBox, and IoT Inspector identified vulnerabilities.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-01-09 CVE Reserved
  • 2019-01-09 CVE Published
  • 2019-09-04 First Exploit
  • 2024-08-04 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-125: Out-of-bounds Read
CAPEC
Affected Vendors, Products, and Versions (5)