Cisco Small Business RV320/Small Business RV325 Web-based Interface HTTP Request Session Hijacking improper authentication

Summaryinfo

A vulnerability described as critical has been identified in Cisco Small Business RV320 and Small Business RV325. This affects an unknown part of the component Web-based Interface. Executing a manipulation as part of HTTP Request can lead to improper authentication (Session Hijacking). This vulnerability is handled as CVE-2019-1724. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability has been found in Cisco Small Business RV320 and Small Business RV325 (unknown version) and classified as critical. This vulnerability affects an unknown code block of the component Web-based Interface. The manipulation as part of a HTTP Request leads to a improper authentication vulnerability (Session Hijacking). The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in the session management functionality of the web-based interface for Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. An attacker could use this impersonated session to create a new user account or otherwise control the device with the privileges of the hijacked session. The vulnerability is due to a lack of proper session management controls. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted device. A successful exploit could allow the attacker to take control of an existing user session on the device. Exploitation of the vulnerability requires that an authorized user session is active and that the attacker can craft an HTTP request to impersonate that session.

The bug was discovered 05/01/2019. The weakness was released 05/03/2019 as cisco-sa-20190501-sbr-hijack as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability was named CVE-2019-1724 since 12/06/2018. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 09/12/2023).

The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Cisco

Name

• Small Business RV320
• Small Business RV325

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion