Cisco RV110W/RV130W/RV215W Web-based Management Interface path traversal

Summaryinfo

A vulnerability was found in Cisco RV110W, RV130W and RV215W and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Web-based Management Interface. Executing a manipulation can lead to path traversal. This vulnerability appears as CVE-2018-0426. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco RV110W, RV130W and RV215W (Router Operating System) (the affected version is unknown). It has been declared as problematic. This vulnerability affects an unknown code of the component Web-based Management Interface. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality. CVE summarizes:

A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of directory traversal character sequences within the web-based management interface. An attacker could exploit this vulnerability by sending malicious requests to the targeted device. A successful exploit could allow the attacker to gain access to arbitrary files on the affected device, resulting in the disclosure of sensitive information.

The bug was discovered 09/05/2018. The weakness was presented 10/05/2018 as cisco-sa-20180905-rv-routers-t as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability was named CVE-2018-0426 since 11/26/2017. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1006.

The vulnerability was handled as a non-public zero-day exploit for at least 30 days. During that time the estimated underground price was around $5k-$25k.

Upgrading eliminates this vulnerability.

See VDB-124827, VDB-124826 and VDB-124825 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• RV110W
• RV130W
• RV215W

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion