Cisco RV180W/RV220W Web Framework SQL sql injection

Summaryinfo

A vulnerability labeled as critical has been found in Cisco RV180W and RV220W. This vulnerability affects unknown code of the component Web Framework. Such manipulation leads to sql injection (SQL). This vulnerability is referenced as CVE-2018-0404. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Cisco RV180W and RV220W (Router Operating System) (the affected version unknown). It has been rated as critical. Affected by this issue is an unknown part of the component Web Framework. The manipulation with an unknown input leads to a sql injection vulnerability (SQL). Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in the web framework code for Cisco RV180W Wireless-N Multifunction VPN Router and Small Business RV Series RV220W Wireless Network Security Firewall could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The attacker could retrieve sensitive information which should be restricted. A vulnerability in the web framework code for Cisco RV180W Wireless-N Multifunction VPN Router and Small Business RV Series RV220W Wireless Network Security Firewall could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The attacker could retrieve sensitive information which should be restricted. The product has entered the end-of-life phase and there will be no more firmware fixes.

The bug was discovered 11/27/2017. The weakness was published 10/05/2018 (Website). The advisory is shared for download at bst.cloudapps.cisco.com. This vulnerability is handled as CVE-2018-0404 since 11/26/2017. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1505.

The vulnerability was handled as a non-public zero-day exploit for at least 312 days. During that time the estimated underground price was around $5k-$25k.

Upgrading eliminates this vulnerability.

Similar entry is available at VDB-124821. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• RV180W
• RV220W

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion