FKIE_CVE-2019-1913

Vulnerability from fkie_nvd - Published: 2019-08-07 06:15 - Updated: 2024-11-21 04:37
Severity ?
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Multiple vulnerabilities in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote attacker to overflow a buffer, which then allows the execution of arbitrary code with root privileges on the underlying operating system. The vulnerabilities are due to insufficient validation of user-supplied input and improper boundary checks when reading data into an internal buffer. An attacker could exploit these vulnerabilities by sending malicious requests to the web management interface of an affected device. Depending on the configuration of the affected switch, the malicious requests must be sent via HTTP or HTTPS.
References
psirt@cisco.comhttp://packetstormsecurity.com/files/154667/Realtek-Managed-Switch-Controller-RTL83xx-Stack-Overflow.html
psirt@cisco.comhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190806-sb220-rceVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/154667/Realtek-Managed-Switch-Controller-RTL83xx-Stack-Overflow.html
af854a3a-2127-422b-91ae-364da2661108https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190806-sb220-rceVendor Advisory
Impacted products
Vendor Product Version
cisco sf-220-24_firmware *
cisco sf-220-24 -
cisco sf220-24p_firmware *
cisco sf220-24p -
cisco sf220-48_firmware *
cisco sf220-48 -
cisco sf220-48p_firmware *
cisco sf220-48p -
cisco sg220-26_firmware *
cisco sg220-26 -
cisco sg220-26p_firmware *
cisco sg220-26p -
cisco sg220-28_firmware *
cisco sg220-28 -
cisco sg220-28mp_firmware *
cisco sg220-28mp -
cisco sg220-50_firmware *
cisco sg220-50 -
cisco sg220-50p_firmware *
cisco sg220-50p -
cisco sg220-52_firmware *
cisco sg220-52 -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sf-220-24_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "172DA894-0F90-4DC5-8A24-6184FBF4867F",
              "versionEndExcluding": "1.1.4.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sf-220-24:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "727ED808-5B61-4379-8FC0-D3EFB4AEBC48",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sf220-24p_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "78CE146A-5B76-42B1-A508-C4D0648D0F00",
              "versionEndExcluding": "1.1.4.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sf220-24p:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "02258A44-A9BA-471B-AEEC-BDCBD44D6BD0",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sf220-48_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C11A7970-8195-45DC-B06F-389B78694FA5",
              "versionEndExcluding": "1.1.4.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sf220-48:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AC0EB976-563C-41B9-9F3F-2584721EDAA7",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sf220-48p_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "34FB9812-BA85-4AAF-9DAF-9981237B2419",
              "versionEndExcluding": "1.1.4.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sf220-48p:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AAA7BE42-9570-4550-991A-4B6821D8F723",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sg220-26_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F4AE5C4A-761A-4C14-8603-5736273E3E4F",
              "versionEndExcluding": "1.1.4.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sg220-26:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "69CE90A1-9914-457B-9E23-E63765275D62",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sg220-26p_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AFADDDC4-932F-4921-A95E-7FBCB6D0E2A9",
              "versionEndExcluding": "1.1.4.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sg220-26p:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F70FBA10-934C-45F6-A01D-4BAD5F421C96",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sg220-28_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "270F99AC-BAFC-4AE4-8B37-041036E55569",
              "versionEndExcluding": "1.1.4.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sg220-28:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "80A37E7F-E8C1-4B47-828A-A35E37D88EC0",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sg220-28mp_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E4B8DD39-B0FA-4A9C-B5A9-9B699C2ECE5F",
              "versionEndExcluding": "1.1.4.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sg220-28mp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "67CDEE3C-5A58-45A4-B092-07CA9418131F",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sg220-50_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6D64F75A-B865-4601-A5CB-52B5B4D1EEAB",
              "versionEndExcluding": "1.1.4.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sg220-50:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E024644E-83BD-49CA-8E27-8977B15713BE",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sg220-50p_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "08588A15-5465-4219-8CBC-A53E9587BD62",
              "versionEndExcluding": "1.1.4.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sg220-50p:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "808746E3-4A3D-44F3-8510-52D699F7D3C2",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sg220-52_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "18FDB744-9725-440E-A123-69496067EDBF",
              "versionEndExcluding": "1.1.4.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:sg220-52:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9C831CAB-9A14-437D-AF6C-A3C81B2CD67A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple vulnerabilities in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote attacker to overflow a buffer, which then allows the execution of arbitrary code with root privileges on the underlying operating system. The vulnerabilities are due to insufficient validation of user-supplied input and improper boundary checks when reading data into an internal buffer. An attacker could exploit these vulnerabilities by sending malicious requests to the web management interface of an affected device. Depending on the configuration of the affected switch, the malicious requests must be sent via HTTP or HTTPS."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades en la interfaz de administraci\u00f3n web de los Switches Small Business 220 Series Smart de Cisco, podr\u00edan permitir que un atacante remoto no autenticado desbordar un b\u00fafer, que luego permite la ejecuci\u00f3n de c\u00f3digo arbitrario con privilegios root en el sistema operativo subyacente. Las vulnerabilidades son debido a una comprobaci\u00f3n insuficiente de la entrada suministrada por el usuario y a controles de l\u00edmites inapropiados cuando se leen datos en un b\u00fafer interno. Un atacante podr\u00eda explotar estas vulnerabilidades enviando peticiones maliciosas a la interfaz de administraci\u00f3n web de un dispositivo afectado. Dependiendo de la configuraci\u00f3n del switch afectado, las peticiones maliciosas deben enviarse por medio de HTTP o HTTPS."
    }
  ],
  "id": "CVE-2019-1913",
  "lastModified": "2024-11-21T04:37:40.477",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "psirt@cisco.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-08-07T06:15:11.933",
  "references": [
    {
      "source": "psirt@cisco.com",
      "url": "http://packetstormsecurity.com/files/154667/Realtek-Managed-Switch-Controller-RTL83xx-Stack-Overflow.html"
    },
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190806-sb220-rce"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://packetstormsecurity.com/files/154667/Realtek-Managed-Switch-Controller-RTL83xx-Stack-Overflow.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190806-sb220-rce"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "psirt@cisco.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.