Lucene search

[email protected]CVE-2019-1653

HistoryJan 24, 2019 - 4:29 p.m.

CVE-2019-1653

2019-01-2416:29:00

CWE-284

CWE-200

[email protected]

web.nvd.nist.gov

1010

In Wild

cve-2019-1653

cisco

small business

rv320

rv325

dual gigabit

wan

vpn

routers

vulnerability

nvd

cisco firmware updates

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

6.4 Medium

AI Score

Confidence

High

0.976 High

EPSS

Percentile

100.0%

JSON

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and requesting specific URLs. A successful exploit could allow the attacker to download the router configuration or detailed diagnostic information. Cisco has released firmware updates that address this vulnerability.

Affected configurations

NVD

Node

ciscorv320_firmwareMatch1.4.2.15

ciscorv320_firmwareMatch1.4.2.17

AND

ciscorv320Match-

Node

ciscorv325_firmwareMatch1.4.2.15

ciscorv325_firmwareMatch1.4.2.17

AND

ciscorv325Match-

CPENameOperatorVersion
cisco:rv320_firmwarecisco rv320 firmwareeq1.4.2.15
cisco:rv320_firmwarecisco rv320 firmwareeq1.4.2.17

CPE	Name	Operator	Version
cisco:rv320_firmware	cisco rv320 firmware	eq	1.4.2.15
cisco:rv320_firmware	cisco rv320 firmware	eq	1.4.2.17

CNA Affected

[
  {
    "product": "Cisco Small Business RV Series Router Firmware ",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]