Critical Cisco Security Flaws Allow Complete Router Firewall Takeover
Cisco patched critical vulnerabilities with Cisco Small Business that allows a remote attacker to take full control of the high-privileged account. Also fixed a privilege escalation vulnerability that impacts Cisco Prime License Manager (PLM) Software.
The patch covers 5 critical vulnerabilities other 22 high and medium severity security vulnerabilities impacting several routers, WebEx, Cisco SD-WAN Solution Software versions and other software.
All the 5 critical vulnerabilities rated 9.8 out of 10 CVSS base score, Following are the critical vulnerabilities.
CVE-2020-3330
The vulnerability is in Cisco Small Business RV110W Wireless-N VPN Firewall Routers, it exists because of a default system account with a static password. By exploiting the device attacker can take complete control over the affected system.
CVE-2020-3323
The vulnerability resides in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers. The vulnerability is due to improper validation of user-supplied input in the web-based management interface.
CVE-2020-3144
A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, RV130 VPN Router, RV130W Wireless-N Multifunction VPN Router, and RV215W Wireless-N VPN Router.
The vulnerability is due to improper session management, successful exploitation allows an attacker to execute arbitrary code as the root user on the vulnerability.
CVE-2020-3331
The web-based management interface of the Cisco RV110W Wireless-N VPN Firewall and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device.
The vulnerability is due to improper validation of user-supplied input in the web-based management interface.
CVE-2020-3140
The vulnerability resides with the web management interface of Cisco Prime License Manager (PLM) Software could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device.
The vulnerability is due to improper validation of user-supplied input in the web-based management interface.
Cisco patch covers all the 27 vulnerabilities including the critical, high, and medium severity security vulnerabilities impacting several routers, WebEx, Cisco SD-WAN Solution Software versions, and other software.
This post Critical Cisco Security Flaws Allow Complete Router Firewall Takeover originally appeared on GB Hackers.
