Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. The vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device. Cisco has not released software updates that address these vulnerabilities.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

栈缓冲区溢出

多款Cisco产品缓冲区错误漏洞

Cisco RV110W等都是美国思科（Cisco）公司的一款路由器。 多款思科 Cisco Small Business 路由器存在缓冲区错误漏洞，该漏洞源于在基于web的管理界面中对用户提供的输入进行了不适当的验证。攻击者可利用该漏洞可以通过向受影响的设备发送精心制作的HTTP请求来利用这些漏洞。成功利用漏洞可以让攻击者可利用该漏洞以根用户的身份在底层操作系统或ca上执行任意代码。以下设备或型号存在此漏洞：Cisco Small Business RV110W、Cisco Small Business

N/A

缓冲区错误