Cisco Small Business 220 up to 1.1.4.3 Web Management Interface improper authorization

Summaryinfo

A vulnerability, which was classified as critical, was found in Cisco Small Business 220 up to 1.1.4.3. The affected element is an unknown function of the component Web Management Interface. The manipulation results in improper authorization. This vulnerability is identified as CVE-2019-1912. The attack can be executed remotely. Additionally, an exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco Small Business 220 up to 1.1.4.3. It has been classified as critical. Affected is some unknown functionality of the component Web Management Interface. The manipulation with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote attacker to upload arbitrary files. The vulnerability is due to incomplete authorization checks in the web management interface. An attacker could exploit this vulnerability by sending a malicious request to certain parts of the web management interface. Depending on the configuration of the affected switch, the malicious request must be sent via HTTP or HTTPS. A successful exploit could allow the attacker to modify the configuration of an affected device or to inject a reverse shell. This vulnerability affects Cisco Small Business 220 Series Smart Switches running firmware versions prior to 1.1.4.4 with the web management interface enabled. The web management interface is enabled via both HTTP and HTTPS by default.

The weakness was released 08/07/2019 as cisco-sa-20190806-sb220-auth_b as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability is traded as CVE-2019-1912 since 12/06/2018. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1548.002. The advisory points out:

The vulnerability is due to incomplete authorization checks in the web management interface. An attacker could exploit this vulnerability by sending a malicious request to certain parts of the web management interface. Depending on the configuration of the affected switch, the malicious request must be sent via HTTP or HTTPS. A successful exploit could allow the attacker to modify the configuration of an affected device or to inject a reverse shell.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. As 0-day the estimated underground price was around $5k-$25k.

Upgrading to version 1.1.4.4 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (47442). Further details are available at zdnet.com. Entries connected to this vulnerability are available at VDB-139597 and VDB-139598. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Cisco

Name

• Small Business 220

Version

• 1.1.4.0
• 1.1.4.1
• 1.1.4.2
• 1.1.4.3

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion