// For flags

CVE-2020-3150

Cisco Small Business RV110W and RV215W Series Routers Information Disclosure Vulnerability

Severity Score

5.9
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

A vulnerability in the web-based management interface of Cisco Small Business RV110W and RV215W Series Routers could allow an unauthenticated, remote attacker to download sensitive information from the device, which could include the device configuration. The vulnerability is due to improper authorization of an HTTP request. An attacker could exploit this vulnerability by accessing a specific URI on the web-based management interface of the router, but only after any valid user has opened a specific file on the device since the last reboot. A successful exploit would allow the attacker to view sensitive information, which should be restricted.

Una vulnerabilidad en la interfaz de administración basada en web de Cisco Small Business RV110W and RV215W Series Routers, podría permitir a un atacante remoto no autenticado descargar información confidencial del dispositivo, lo que podría incluir la configuración del dispositivo. La vulnerabilidad es debido a una autorización inapropiada de una petición HTTP. Un atacante podría explotar esta vulnerabilidad mediante el acceso a un URI específico en la interfaz de administración basada en web del enrutador, pero solo después de que cualquier usuario válido haya abierto un archivo específico en el dispositivo desde el último reinicio. Una explotación con éxito permitiría al atacante visualizar información confidencial, que debería ser restringida

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2019-12-12 CVE Reserved
  • 2020-07-16 CVE Published
  • 2023-07-20 EPSS Updated
  • 2024-11-15 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-285: Improper Authorization
  • CWE-863: Incorrect Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Rv110w Firmware
Search vendor "Cisco" for product "Rv110w Firmware"
 < 1.2.2.8
Search vendor "Cisco" for product "Rv110w Firmware" and version " < 1.2.2.8"
-
Affected
in Cisco
Search vendor "Cisco"
 Rv110w
Search vendor "Cisco" for product "Rv110w"
--
Safe
Cisco
Search vendor "Cisco"
 Rv215w Firmware
Search vendor "Cisco" for product "Rv215w Firmware"
 < 1.3.1.7
Search vendor "Cisco" for product "Rv215w Firmware" and version " < 1.3.1.7"
-
Affected
in Cisco
Search vendor "Cisco"
 Rv215w
Search vendor "Cisco" for product "Rv215w"
--
Safe