A vulnerability, which was classified as critical, has been found in Cisco RV110W, RV130, RV130W and RV215W (Router Operating System) (the affected version is unknown). This issue affects an unknown code of the component Web-based Management Interface. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Multiple vulnerabilities in the web-based management interface of Cisco RV110W, RV130, RV130W, and RV215W Series Routers could allow an authenticated, remote attacker with administrative privileges to execute arbitrary commands. For more information about these vulnerabilities, see the Details section of this advisory.

The weakness was released 06/18/2020 as cisco-sa-rv-routers-injection- as confirmed advisory (Website). The advisory is shared at tools.cisco.com. The identification of this vulnerability is CVE-2020-3268 since 12/12/2019. The attack may be initiated remotely. A simple authentication is needed for exploitation. Neither technical details nor an exploit are publicly available.

Upgrading eliminates this vulnerability.

Entry connected to this vulnerability is available at 156882.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• RV110W
• RV130
• RV130W
• RV215W

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion