Vulnerabilites related to cisco - sf220-24_firmware
cve-2021-1542
Vulnerability from cvelistv5
Published
2021-06-16 17:45
Modified
2024-11-07 22:07
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco Small Business 220 Series Smart Plus Switches |
Version: n/a |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-03T16:11:17.816Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "20210616 Cisco Small Business 220 Series Smart Switches Vulnerabilities", tags: [ "vendor-advisory", "x_refsource_CISCO", "x_transferred", ], url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2021-1542", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-11-07T21:43:40.657807Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-11-07T22:07:56.420Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "Cisco Small Business 220 Series Smart Plus Switches", vendor: "Cisco", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2021-06-16T00:00:00", descriptions: [ { lang: "en", value: "Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.", }, ], exploits: [ { lang: "en", value: "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.2, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-287", description: "CWE-287", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2021-06-16T17:45:51", orgId: "d1c1063e-7a18-46af-9102-31f8928bc633", shortName: "cisco", }, references: [ { name: "20210616 Cisco Small Business 220 Series Smart Switches Vulnerabilities", tags: [ "vendor-advisory", "x_refsource_CISCO", ], url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E", }, ], source: { advisory: "cisco-sa-ciscosb-multivulns-Wwyb7s5E", defect: [ [ "CSCvx57830", "CSCvx57925", "CSCvx57935", ], ], discovery: "INTERNAL", }, title: "Cisco Small Business 220 Series Smart Switches Vulnerabilities", x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "psirt@cisco.com", DATE_PUBLIC: "2021-06-16T16:00:00", ID: "CVE-2021-1542", STATE: "PUBLIC", TITLE: "Cisco Small Business 220 Series Smart Switches Vulnerabilities", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Cisco Small Business 220 Series Smart Plus Switches", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "Cisco", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.", }, ], }, exploit: [ { lang: "en", value: "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.", }, ], impact: { cvss: { baseScore: "7.5", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "CWE-287", }, ], }, ], }, references: { reference_data: [ { name: "20210616 Cisco Small Business 220 Series Smart Switches Vulnerabilities", refsource: "CISCO", url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E", }, ], }, source: { advisory: "cisco-sa-ciscosb-multivulns-Wwyb7s5E", defect: [ [ "CSCvx57830", "CSCvx57925", "CSCvx57935", ], ], discovery: "INTERNAL", }, }, }, }, cveMetadata: { assignerOrgId: "d1c1063e-7a18-46af-9102-31f8928bc633", assignerShortName: "cisco", cveId: "CVE-2021-1542", datePublished: "2021-06-16T17:45:51.976856Z", dateReserved: "2020-11-13T00:00:00", dateUpdated: "2024-11-07T22:07:56.420Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2021-1571
Vulnerability from cvelistv5
Published
2021-06-16 17:45
Modified
2024-11-07 22:08
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco Small Business 220 Series Smart Plus Switches |
Version: n/a |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-03T16:18:10.979Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "20210616 Cisco Small Business 220 Series Smart Switches Vulnerabilities", tags: [ "vendor-advisory", "x_refsource_CISCO", "x_transferred", ], url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2021-1571", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-11-07T21:43:46.562517Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-11-07T22:08:40.015Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "Cisco Small Business 220 Series Smart Plus Switches", vendor: "Cisco", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2021-06-16T00:00:00", descriptions: [ { lang: "en", value: "Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.", }, ], exploits: [ { lang: "en", value: "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.2, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-287", description: "CWE-287", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2021-06-16T17:45:12", orgId: "d1c1063e-7a18-46af-9102-31f8928bc633", shortName: "cisco", }, references: [ { name: "20210616 Cisco Small Business 220 Series Smart Switches Vulnerabilities", tags: [ "vendor-advisory", "x_refsource_CISCO", ], url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E", }, ], source: { advisory: "cisco-sa-ciscosb-multivulns-Wwyb7s5E", defect: [ [ "CSCvx57830", "CSCvx57925", "CSCvx57935", ], ], discovery: "INTERNAL", }, title: "Cisco Small Business 220 Series Smart Switches Vulnerabilities", x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "psirt@cisco.com", DATE_PUBLIC: "2021-06-16T16:00:00", ID: "CVE-2021-1571", STATE: "PUBLIC", TITLE: "Cisco Small Business 220 Series Smart Switches Vulnerabilities", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Cisco Small Business 220 Series Smart Plus Switches", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "Cisco", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.", }, ], }, exploit: [ { lang: "en", value: "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.", }, ], impact: { cvss: { baseScore: "7.5", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "CWE-287", }, ], }, ], }, references: { reference_data: [ { name: "20210616 Cisco Small Business 220 Series Smart Switches Vulnerabilities", refsource: "CISCO", url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E", }, ], }, source: { advisory: "cisco-sa-ciscosb-multivulns-Wwyb7s5E", defect: [ [ "CSCvx57830", "CSCvx57925", "CSCvx57935", ], ], discovery: "INTERNAL", }, }, }, }, cveMetadata: { assignerOrgId: "d1c1063e-7a18-46af-9102-31f8928bc633", assignerShortName: "cisco", cveId: "CVE-2021-1571", datePublished: "2021-06-16T17:45:12.098683Z", dateReserved: "2020-11-13T00:00:00", dateUpdated: "2024-11-07T22:08:40.015Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2021-1541
Vulnerability from cvelistv5
Published
2021-06-16 17:35
Modified
2024-11-07 22:08
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco Small Business 220 Series Smart Plus Switches |
Version: n/a |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-03T16:11:17.682Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "20210616 Cisco Small Business 220 Series Smart Switches Vulnerabilities", tags: [ "vendor-advisory", "x_refsource_CISCO", "x_transferred", ], url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2021-1541", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-11-07T21:43:47.956650Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-11-07T22:08:46.480Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "Cisco Small Business 220 Series Smart Plus Switches", vendor: "Cisco", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2021-06-16T00:00:00", descriptions: [ { lang: "en", value: "Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.", }, ], exploits: [ { lang: "en", value: "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.2, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-287", description: "CWE-287", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2021-06-16T17:35:34", orgId: "d1c1063e-7a18-46af-9102-31f8928bc633", shortName: "cisco", }, references: [ { name: "20210616 Cisco Small Business 220 Series Smart Switches Vulnerabilities", tags: [ "vendor-advisory", "x_refsource_CISCO", ], url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E", }, ], source: { advisory: "cisco-sa-ciscosb-multivulns-Wwyb7s5E", defect: [ [ "CSCvx57830", "CSCvx57925", "CSCvx57935", ], ], discovery: "INTERNAL", }, title: "Cisco Small Business 220 Series Smart Switches Vulnerabilities", x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "psirt@cisco.com", DATE_PUBLIC: "2021-06-16T16:00:00", ID: "CVE-2021-1541", STATE: "PUBLIC", TITLE: "Cisco Small Business 220 Series Smart Switches Vulnerabilities", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Cisco Small Business 220 Series Smart Plus Switches", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "Cisco", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.", }, ], }, exploit: [ { lang: "en", value: "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.", }, ], impact: { cvss: { baseScore: "7.5", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "CWE-287", }, ], }, ], }, references: { reference_data: [ { name: "20210616 Cisco Small Business 220 Series Smart Switches Vulnerabilities", refsource: "CISCO", url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E", }, ], }, source: { advisory: "cisco-sa-ciscosb-multivulns-Wwyb7s5E", defect: [ [ "CSCvx57830", "CSCvx57925", "CSCvx57935", ], ], discovery: "INTERNAL", }, }, }, }, cveMetadata: { assignerOrgId: "d1c1063e-7a18-46af-9102-31f8928bc633", assignerShortName: "cisco", cveId: "CVE-2021-1541", datePublished: "2021-06-16T17:35:34.689911Z", dateReserved: "2020-11-13T00:00:00", dateUpdated: "2024-11-07T22:08:46.480Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2021-1543
Vulnerability from cvelistv5
Published
2021-06-16 17:45
Modified
2024-11-07 22:08
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco Small Business 220 Series Smart Plus Switches |
Version: n/a |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-03T16:11:17.669Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "20210616 Cisco Small Business 220 Series Smart Switches Vulnerabilities", tags: [ "vendor-advisory", "x_refsource_CISCO", "x_transferred", ], url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2021-1543", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-11-07T21:43:41.836462Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-11-07T22:08:03.454Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "Cisco Small Business 220 Series Smart Plus Switches", vendor: "Cisco", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2021-06-16T00:00:00", descriptions: [ { lang: "en", value: "Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.", }, ], exploits: [ { lang: "en", value: "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.2, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-287", description: "CWE-287", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2021-06-16T17:45:46", orgId: "d1c1063e-7a18-46af-9102-31f8928bc633", shortName: "cisco", }, references: [ { name: "20210616 Cisco Small Business 220 Series Smart Switches Vulnerabilities", tags: [ "vendor-advisory", "x_refsource_CISCO", ], url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E", }, ], source: { advisory: "cisco-sa-ciscosb-multivulns-Wwyb7s5E", defect: [ [ "CSCvx57830", "CSCvx57925", "CSCvx57935", ], ], discovery: "INTERNAL", }, title: "Cisco Small Business 220 Series Smart Switches Vulnerabilities", x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "psirt@cisco.com", DATE_PUBLIC: "2021-06-16T16:00:00", ID: "CVE-2021-1543", STATE: "PUBLIC", TITLE: "Cisco Small Business 220 Series Smart Switches Vulnerabilities", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Cisco Small Business 220 Series Smart Plus Switches", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "Cisco", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.", }, ], }, exploit: [ { lang: "en", value: "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.", }, ], impact: { cvss: { baseScore: "7.5", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "CWE-287", }, ], }, ], }, references: { reference_data: [ { name: "20210616 Cisco Small Business 220 Series Smart Switches Vulnerabilities", refsource: "CISCO", url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E", }, ], }, source: { advisory: "cisco-sa-ciscosb-multivulns-Wwyb7s5E", defect: [ [ "CSCvx57830", "CSCvx57925", "CSCvx57935", ], ], discovery: "INTERNAL", }, }, }, }, cveMetadata: { assignerOrgId: "d1c1063e-7a18-46af-9102-31f8928bc633", assignerShortName: "cisco", cveId: "CVE-2021-1543", datePublished: "2021-06-16T17:45:46.371556Z", dateReserved: "2020-11-13T00:00:00", dateUpdated: "2024-11-07T22:08:03.454Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
Vulnerability from fkie_nvd
Published
2021-06-16 18:15
Modified
2024-11-21 05:44
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | sf220-24_firmware | * | |
| cisco | sf220-24 | - | |
| cisco | sf220-24p_firmware | * | |
| cisco | sf220-24p | - | |
| cisco | sf220-48_firmware | * | |
| cisco | sf220-48 | - | |
| cisco | sf220-48p_firmware | * | |
| cisco | sf220-48p | - | |
| cisco | sg220-26_firmware | * | |
| cisco | sg220-26 | - | |
| cisco | sg220-26p_firmware | * | |
| cisco | sg220-26p | - | |
| cisco | sg220-28mp_firmware | * | |
| cisco | sg220-28mp | - | |
| cisco | sg220-50_firmware | * | |
| cisco | sg220-50 | - | |
| cisco | sg220-50p_firmware | * | |
| cisco | sg220-50p | - |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sf220-24_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "592CAF99-2CD8-46F2-8715-9930F22A4DE8", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sf220-24:-:*:*:*:*:*:*:*", matchCriteriaId: "7CBD8429-E036-4934-AF6A-3B5095F87ADF", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sf220-24p_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "513E4F52-6493-4A92-90CA-8A92CC9ECA8C", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sf220-24p:-:*:*:*:*:*:*:*", matchCriteriaId: "02258A44-A9BA-471B-AEEC-BDCBD44D6BD0", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sf220-48_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "DE41D686-C6AB-46E5-899C-523BC9E216C7", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sf220-48:-:*:*:*:*:*:*:*", matchCriteriaId: "AC0EB976-563C-41B9-9F3F-2584721EDAA7", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sf220-48p_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "9CAA3662-6E4A-4842-A667-31634AF59437", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sf220-48p:-:*:*:*:*:*:*:*", matchCriteriaId: "AAA7BE42-9570-4550-991A-4B6821D8F723", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sg220-26_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "02042FA3-B98E-4BED-BB2F-B50E010D9EFC", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sg220-26:-:*:*:*:*:*:*:*", matchCriteriaId: "69CE90A1-9914-457B-9E23-E63765275D62", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sg220-26p_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "D704F371-A2A4-417B-825E-E083AC8EBC89", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sg220-26p:-:*:*:*:*:*:*:*", matchCriteriaId: "F70FBA10-934C-45F6-A01D-4BAD5F421C96", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sg220-28mp_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "458DC6B7-781D-4AA9-90D1-773C7DCFBE59", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sg220-28mp:-:*:*:*:*:*:*:*", matchCriteriaId: "67CDEE3C-5A58-45A4-B092-07CA9418131F", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sg220-50_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "C1478637-D8E5-477C-B487-C3D0AD623B90", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sg220-50:-:*:*:*:*:*:*:*", matchCriteriaId: "E024644E-83BD-49CA-8E27-8977B15713BE", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sg220-50p_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "52346644-43C4-45C5-905E-6A3F95806FF4", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sg220-50p:-:*:*:*:*:*:*:*", matchCriteriaId: "808746E3-4A3D-44F3-8510-52D699F7D3C2", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, ], cveTags: [], descriptions: [ { lang: "en", value: "Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.", }, { lang: "es", value: "Múltiples vulnerabilidades en la interfaz de administración basada en web de Cisco Small Business 220 Series Smart Switches podrían permitir a un atacante hacer lo siguiente: Secuestrar una sesión de usuario, Ejecutar comandos arbitrarios como usuario root en el sistema operativo subyacente, Conducir un ataque de tipo cross-site scripting (XSS), Conducir un ataque de inyección HTML. Para mayor información sobre estas vulnerabilidades, consulte la sección Detalles de este aviso", }, ], id: "CVE-2021-1543", lastModified: "2024-11-21T05:44:35.237", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.2, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 1.2, impactScore: 5.9, source: "psirt@cisco.com", type: "Secondary", }, { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2021-06-16T18:15:08.590", references: [ { source: "psirt@cisco.com", tags: [ "Vendor Advisory", ], url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E", }, ], sourceIdentifier: "psirt@cisco.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-287", }, ], source: "psirt@cisco.com", type: "Secondary", }, { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2021-06-16 18:15
Modified
2024-11-21 05:44
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | sf220-24_firmware | * | |
| cisco | sf220-24 | - | |
| cisco | sf220-24p_firmware | * | |
| cisco | sf220-24p | - | |
| cisco | sf220-48_firmware | * | |
| cisco | sf220-48 | - | |
| cisco | sf220-48p_firmware | * | |
| cisco | sf220-48p | - | |
| cisco | sg220-26_firmware | * | |
| cisco | sg220-26 | - | |
| cisco | sg220-26p_firmware | * | |
| cisco | sg220-26p | - | |
| cisco | sg220-28mp_firmware | * | |
| cisco | sg220-28mp | - | |
| cisco | sg220-50_firmware | * | |
| cisco | sg220-50 | - | |
| cisco | sg220-50p_firmware | * | |
| cisco | sg220-50p | - |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sf220-24_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "592CAF99-2CD8-46F2-8715-9930F22A4DE8", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sf220-24:-:*:*:*:*:*:*:*", matchCriteriaId: "7CBD8429-E036-4934-AF6A-3B5095F87ADF", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sf220-24p_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "513E4F52-6493-4A92-90CA-8A92CC9ECA8C", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sf220-24p:-:*:*:*:*:*:*:*", matchCriteriaId: "02258A44-A9BA-471B-AEEC-BDCBD44D6BD0", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sf220-48_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "DE41D686-C6AB-46E5-899C-523BC9E216C7", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sf220-48:-:*:*:*:*:*:*:*", matchCriteriaId: "AC0EB976-563C-41B9-9F3F-2584721EDAA7", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sf220-48p_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "9CAA3662-6E4A-4842-A667-31634AF59437", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sf220-48p:-:*:*:*:*:*:*:*", matchCriteriaId: "AAA7BE42-9570-4550-991A-4B6821D8F723", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sg220-26_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "02042FA3-B98E-4BED-BB2F-B50E010D9EFC", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sg220-26:-:*:*:*:*:*:*:*", matchCriteriaId: "69CE90A1-9914-457B-9E23-E63765275D62", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sg220-26p_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "D704F371-A2A4-417B-825E-E083AC8EBC89", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sg220-26p:-:*:*:*:*:*:*:*", matchCriteriaId: "F70FBA10-934C-45F6-A01D-4BAD5F421C96", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sg220-28mp_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "458DC6B7-781D-4AA9-90D1-773C7DCFBE59", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sg220-28mp:-:*:*:*:*:*:*:*", matchCriteriaId: "67CDEE3C-5A58-45A4-B092-07CA9418131F", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sg220-50_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "C1478637-D8E5-477C-B487-C3D0AD623B90", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sg220-50:-:*:*:*:*:*:*:*", matchCriteriaId: "E024644E-83BD-49CA-8E27-8977B15713BE", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sg220-50p_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "52346644-43C4-45C5-905E-6A3F95806FF4", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sg220-50p:-:*:*:*:*:*:*:*", matchCriteriaId: "808746E3-4A3D-44F3-8510-52D699F7D3C2", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, ], cveTags: [], descriptions: [ { lang: "en", value: "Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.", }, { lang: "es", value: "Múltiples vulnerabilidades en la interfaz de administración basada en web de Cisco Small Business 220 Series Smart Switches podrían permitir a un atacante hacer lo siguiente: Secuestrar una sesión de usuario, Ejecutar comandos arbitrarios como usuario root en el sistema operativo subyacente, Conducir un ataque de tipo cross-site scripting (XSS), Conducir un ataque de inyección HTML. Para mayor información sobre estas vulnerabilidades, consulte la sección Detalles de este aviso", }, ], id: "CVE-2021-1542", lastModified: "2024-11-21T05:44:35.087", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "HIGH", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "COMPLETE", baseScore: 9.3, confidentialityImpact: "COMPLETE", integrityImpact: "COMPLETE", vectorString: "AV:N/AC:M/Au:N/C:C/I:C/A:C", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 10, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.2, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 1.2, impactScore: 5.9, source: "psirt@cisco.com", type: "Secondary", }, { cvssData: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.1, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 2.2, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2021-06-16T18:15:08.473", references: [ { source: "psirt@cisco.com", tags: [ "Vendor Advisory", ], url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E", }, ], sourceIdentifier: "psirt@cisco.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-287", }, ], source: "psirt@cisco.com", type: "Secondary", }, { description: [ { lang: "en", value: "CWE-287", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2021-06-16 18:15
Modified
2024-11-21 05:44
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | sf220-24_firmware | * | |
| cisco | sf220-24 | - | |
| cisco | sf220-24p_firmware | * | |
| cisco | sf220-24p | - | |
| cisco | sf220-48_firmware | * | |
| cisco | sf220-48 | - | |
| cisco | sf220-48p_firmware | * | |
| cisco | sf220-48p | - | |
| cisco | sg220-26_firmware | * | |
| cisco | sg220-26 | - | |
| cisco | sg220-26p_firmware | * | |
| cisco | sg220-26p | - | |
| cisco | sg220-28mp_firmware | * | |
| cisco | sg220-28mp | - | |
| cisco | sg220-50_firmware | * | |
| cisco | sg220-50 | - | |
| cisco | sg220-50p_firmware | * | |
| cisco | sg220-50p | - |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sf220-24_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "592CAF99-2CD8-46F2-8715-9930F22A4DE8", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sf220-24:-:*:*:*:*:*:*:*", matchCriteriaId: "7CBD8429-E036-4934-AF6A-3B5095F87ADF", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sf220-24p_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "513E4F52-6493-4A92-90CA-8A92CC9ECA8C", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sf220-24p:-:*:*:*:*:*:*:*", matchCriteriaId: "02258A44-A9BA-471B-AEEC-BDCBD44D6BD0", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sf220-48_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "DE41D686-C6AB-46E5-899C-523BC9E216C7", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sf220-48:-:*:*:*:*:*:*:*", matchCriteriaId: "AC0EB976-563C-41B9-9F3F-2584721EDAA7", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sf220-48p_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "9CAA3662-6E4A-4842-A667-31634AF59437", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sf220-48p:-:*:*:*:*:*:*:*", matchCriteriaId: "AAA7BE42-9570-4550-991A-4B6821D8F723", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sg220-26_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "02042FA3-B98E-4BED-BB2F-B50E010D9EFC", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sg220-26:-:*:*:*:*:*:*:*", matchCriteriaId: "69CE90A1-9914-457B-9E23-E63765275D62", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sg220-26p_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "D704F371-A2A4-417B-825E-E083AC8EBC89", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sg220-26p:-:*:*:*:*:*:*:*", matchCriteriaId: "F70FBA10-934C-45F6-A01D-4BAD5F421C96", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sg220-28mp_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "458DC6B7-781D-4AA9-90D1-773C7DCFBE59", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sg220-28mp:-:*:*:*:*:*:*:*", matchCriteriaId: "67CDEE3C-5A58-45A4-B092-07CA9418131F", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sg220-50_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "C1478637-D8E5-477C-B487-C3D0AD623B90", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sg220-50:-:*:*:*:*:*:*:*", matchCriteriaId: "E024644E-83BD-49CA-8E27-8977B15713BE", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sg220-50p_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "52346644-43C4-45C5-905E-6A3F95806FF4", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sg220-50p:-:*:*:*:*:*:*:*", matchCriteriaId: "808746E3-4A3D-44F3-8510-52D699F7D3C2", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, ], cveTags: [], descriptions: [ { lang: "en", value: "Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.", }, { lang: "es", value: "Múltiples vulnerabilidades en la interfaz de administración basada en web de Cisco Small Business 220 Series Smart Switches, podrían permitir a un atacante hacer lo siguiente: Secuestrar una sesión de usuario, Ejecutar comandos arbitrarios como usuario root en el sistema operativo subyacente, Conducir un ataque de tipo cross-site scripting (XSS), Conducir un ataque de inyección HTML. Para mayor información sobre estas vulnerabilidades, consulte la sección Detalles de este aviso", }, ], id: "CVE-2021-1571", lastModified: "2024-11-21T05:44:38.893", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.2, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 1.2, impactScore: 5.9, source: "psirt@cisco.com", type: "Secondary", }, { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2021-06-16T18:15:09.450", references: [ { source: "psirt@cisco.com", tags: [ "Patch", "Vendor Advisory", ], url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", "Vendor Advisory", ], url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E", }, ], sourceIdentifier: "psirt@cisco.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-287", }, ], source: "psirt@cisco.com", type: "Secondary", }, { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2021-06-16 18:15
Modified
2024-11-21 05:44
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | sf220-24_firmware | * | |
| cisco | sf220-24 | - | |
| cisco | sf220-24p_firmware | * | |
| cisco | sf220-24p | - | |
| cisco | sf220-48_firmware | * | |
| cisco | sf220-48 | - | |
| cisco | sf220-48p_firmware | * | |
| cisco | sf220-48p | - | |
| cisco | sg220-26_firmware | * | |
| cisco | sg220-26 | - | |
| cisco | sg220-26p_firmware | * | |
| cisco | sg220-26p | - | |
| cisco | sg220-28mp_firmware | * | |
| cisco | sg220-28mp | - | |
| cisco | sg220-50_firmware | * | |
| cisco | sg220-50 | - | |
| cisco | sg220-50p_firmware | * | |
| cisco | sg220-50p | - |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sf220-24_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "592CAF99-2CD8-46F2-8715-9930F22A4DE8", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sf220-24:-:*:*:*:*:*:*:*", matchCriteriaId: "7CBD8429-E036-4934-AF6A-3B5095F87ADF", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sf220-24p_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "513E4F52-6493-4A92-90CA-8A92CC9ECA8C", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sf220-24p:-:*:*:*:*:*:*:*", matchCriteriaId: "02258A44-A9BA-471B-AEEC-BDCBD44D6BD0", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sf220-48_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "DE41D686-C6AB-46E5-899C-523BC9E216C7", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sf220-48:-:*:*:*:*:*:*:*", matchCriteriaId: "AC0EB976-563C-41B9-9F3F-2584721EDAA7", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sf220-48p_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "9CAA3662-6E4A-4842-A667-31634AF59437", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sf220-48p:-:*:*:*:*:*:*:*", matchCriteriaId: "AAA7BE42-9570-4550-991A-4B6821D8F723", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sg220-26_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "02042FA3-B98E-4BED-BB2F-B50E010D9EFC", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sg220-26:-:*:*:*:*:*:*:*", matchCriteriaId: "69CE90A1-9914-457B-9E23-E63765275D62", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sg220-26p_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "D704F371-A2A4-417B-825E-E083AC8EBC89", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sg220-26p:-:*:*:*:*:*:*:*", matchCriteriaId: "F70FBA10-934C-45F6-A01D-4BAD5F421C96", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sg220-28mp_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "458DC6B7-781D-4AA9-90D1-773C7DCFBE59", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sg220-28mp:-:*:*:*:*:*:*:*", matchCriteriaId: "67CDEE3C-5A58-45A4-B092-07CA9418131F", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sg220-50_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "C1478637-D8E5-477C-B487-C3D0AD623B90", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sg220-50:-:*:*:*:*:*:*:*", matchCriteriaId: "E024644E-83BD-49CA-8E27-8977B15713BE", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:cisco:sg220-50p_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "52346644-43C4-45C5-905E-6A3F95806FF4", versionEndExcluding: "1.2.0.6", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:cisco:sg220-50p:-:*:*:*:*:*:*:*", matchCriteriaId: "808746E3-4A3D-44F3-8510-52D699F7D3C2", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, ], cveTags: [], descriptions: [ { lang: "en", value: "Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory.", }, { lang: "es", value: "Múltiples vulnerabilidades en la interfaz de administración basada en web de Cisco Small Business 220 Series Smart Switches podrían permitir a un atacante hacer lo siguiente: Secuestrar una sesión de usuario, Ejecutar comandos arbitrarios como usuario root en el sistema operativo subyacente, Conducir un ataque de tipo cross-site scripting (XSS), Conducir un ataque de inyección HTML. Para mayor información sobre estas vulnerabilidades, consulte la sección Detalles de este aviso", }, ], id: "CVE-2021-1541", lastModified: "2024-11-21T05:44:34.950", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "HIGH", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "COMPLETE", baseScore: 9, confidentialityImpact: "COMPLETE", integrityImpact: "COMPLETE", vectorString: "AV:N/AC:L/Au:S/C:C/I:C/A:C", version: "2.0", }, exploitabilityScore: 8, impactScore: 10, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.2, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 1.2, impactScore: 5.9, source: "psirt@cisco.com", type: "Secondary", }, { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.2, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 1.2, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2021-06-16T18:15:08.347", references: [ { source: "psirt@cisco.com", tags: [ "Vendor Advisory", ], url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E", }, ], sourceIdentifier: "psirt@cisco.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-287", }, ], source: "psirt@cisco.com", type: "Primary", }, ], }