CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2020-3144

CVSS 9.8v3.1pub. 2020-07-16upd. 2024-11-21

A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, RV130 VPN Router, RV130W Wireless-N Multifunction VPN Router, and RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary commands with administrative commands on an affected device. The vulnerability is due to improper session management on affected devices. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to gain administrative access on the affected device.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Cisco Rv110w

    HW
    Cisco
    all versions

  • Cisco Rv110w Firmware

    OS
    Cisco
    < 1.2.2.8

  • Cisco Rv130

    HW
    Cisco
    all versions

  • Cisco Rv130 Firmware

    OS
    Cisco
    < 1.0.3.55

  • Cisco Rv130w

    HW
    Cisco
    all versions

  • Cisco Rv130w Firmware

    OS
    Cisco
    < 1.0.3.55

  • Cisco Rv215w

    HW
    Cisco
    all versions

  • Cisco Rv215w Firmware

    OS
    Cisco
    < 1.3.1.7
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
Auth BypassFirewallVPN
CWE
References

Related vulnerabilities

CVE-2022-20825CRITICAL9.8PL ✓same product

RCE w routerach Cisco Small Business RV110W/RV130/RV215W poprzez stack buffer overflow

CVE-2021-1459CRITICAL9.8PL ✓same product

RCE w interfejsie zarządzania routerów Cisco Small Business RV

CVE-2019-1663CRITICAL9.8PL ✓same product

RCE w interfejsie zarządzania Cisco RV110W, RV130W i RV215W

CVE-2018-0426CRITICAL9.8PL ✓same product

Path Traversal w interfejsie zarządzania routerów Cisco RV110W/RV130W/RV215W

CVE-2018-0425CRITICAL9.8PL ✓same product

Cisco RV110W/RV130W/RV215W — nieautoryzowany dostęp do plików konfiguracyjnych