CVE-2019-1899 - OpenCVE

A vulnerability in the web interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to acquire the list of devices that are connected to the guest network. The vulnerability is due to improper authorization of an HTTP request. An attacker could exploit this vulnerability by accessing a specific URI on the web interface of the router.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Cisco	Rv130w Firmware Rv215w Firmware Rv110w Firmware Rv130w Rv110w Rv215w

Configuration 1 [-]

AND

cpe:2.3:o:cisco:rv110w_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:rv110w:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:cisco:rv130w_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:rv130w:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:cisco:rv215w_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:rv215w:-:*:*:*:*:*:*:*

References

Link	Resource
http://www.securityfocus.com/bid/108867	Third Party Advisory VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-rv-infodis	Vendor Advisory
https://www.tenable.com/security/research/tra-2019-29	Exploit Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: cisco

Published: 2019-06-19T00:00:00

Updated: 2019-06-26T18:31:49

Reserved: 2018-12-06T00:00:00

Link: CVE-2019-1899

JSON object: View

NVD Information

Status : Analyzed

Published: 2019-06-20T03:15:12.480

Modified: 2020-10-16T15:06:35.137

Link: CVE-2019-1899

JSON object: View

Redhat Information

No data.

CWE

{"containers": {"cna": {"affected": [{"product": "Cisco RV130W Wireless-N Multifunction VPN Router Firmware ", "vendor": "Cisco", "versions": [{"lessThan": "1.0.3.51", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2019-06-19T00:00:00", "descriptions": [{"lang": "en", "value": "A vulnerability in the web interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to acquire the list of devices that are connected to the guest network. The vulnerability is due to improper authorization of an HTTP request. An attacker could exploit this vulnerability by accessing a specific URI on the web interface of the router."}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. "}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "description": "CWE-285", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-06-26T18:31:49", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco"}, "references": [{"name": "20190619 Cisco RV110W, RV130W, and RV215W Routers Information Disclosure Vulnerability", "tags": ["vendor-advisory", "x_refsource_CISCO"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-rv-infodis"}, {"tags": ["x_refsource_MISC"], "url": "https://www.tenable.com/security/research/tra-2019-29"}, {"name": "108867", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/108867"}], "source": {"advisory": "cisco-sa-20190619-rv-infodis", "defect": [["CSCvo65058", "CSCvo65061", "CSCvo65062"]], "discovery": "INTERNAL"}, "title": "Cisco RV110W, RV130W, and RV215W Routers Information Disclosure Vulnerability", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@cisco.com", "DATE_PUBLIC": "2019-06-19T16:00:00-0700", "ID": "CVE-2019-1899", "STATE": "PUBLIC", "TITLE": "Cisco RV110W, RV130W, and RV215W Routers Information Disclosure Vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Cisco RV130W Wireless-N Multifunction VPN Router Firmware ", "version": {"version_data": [{"affected": "<", "version_affected": "<", "version_value": "1.0.3.51"}]}}]}, "vendor_name": "Cisco"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability in the web interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to acquire the list of devices that are connected to the guest network. The vulnerability is due to improper authorization of an HTTP request. An attacker could exploit this vulnerability by accessing a specific URI on the web interface of the router."}]}, "exploit": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. "}], "impact": {"cvss": {"baseScore": "5.3", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N ", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-285"}]}]}, "references": {"reference_data": [{"name": "20190619 Cisco RV110W, RV130W, and RV215W Routers Information Disclosure Vulnerability", "refsource": "CISCO", "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-rv-infodis"}, {"name": "https://www.tenable.com/security/research/tra-2019-29", "refsource": "MISC", "url": "https://www.tenable.com/security/research/tra-2019-29"}, {"name": "108867", "refsource": "BID", "url": "http://www.securityfocus.com/bid/108867"}]}, "source": {"advisory": "cisco-sa-20190619-rv-infodis", "defect": [["CSCvo65058", "CSCvo65061", "CSCvo65062"]], "discovery": "INTERNAL"}}}}, "cveMetadata": {"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2019-1899", "datePublished": "2019-06-19T00:00:00", "dateReserved": "2018-12-06T00:00:00", "dateUpdated": "2019-06-26T18:31:49", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:cisco:rv110w_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "981CCB8D-D73D-469A-9BB2-4612E132FC38", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:cisco:rv110w:-:*:*:*:*:*:*:*", "matchCriteriaId": "20E8ECAC-E842-41DB-9612-9374A9648DC2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:cisco:rv130w_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "A4E299E1-FDD8-4DF4-B255-1F8FACC7664B", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:cisco:rv130w:-:*:*:*:*:*:*:*", "matchCriteriaId": "C3C9AFAA-1387-4067-AF7E-2E4AAD2A272A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:cisco:rv215w_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "78E44728-3154-40D6-B051-57B4BD869551", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:cisco:rv215w:-:*:*:*:*:*:*:*", "matchCriteriaId": "8686AB22-F757-468A-930B-DDE45B508969", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to acquire the list of devices that are connected to the guest network. The vulnerability is due to improper authorization of an HTTP request. An attacker could exploit this vulnerability by accessing a specific URI on the web interface of the router."}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz web de los enrutadores RV110W, RV130W y RV215W de Cisco, podr\u00eda permitir que un atacante remoto no autenticado adquiera la lista de dispositivos que est\u00e1n conectados en la red de invitado. Una vulnerabilidad es debido a la autorizaci\u00f3n inapropiada de una petici\u00f3n HTTP. Un atacante podr\u00eda explotar esta vulnerabilidad al acceder a un URI espec\u00edfico en la interfaz web del enrutador."}], "id": "CVE-2019-1899", "lastModified": "2020-10-16T15:06:35.137", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "ykramarz@cisco.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-06-20T03:15:12.480", "references": [{"source": "ykramarz@cisco.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/108867"}, {"source": "ykramarz@cisco.com", "tags": ["Vendor Advisory"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-rv-infodis"}, {"source": "ykramarz@cisco.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.tenable.com/security/research/tra-2019-29"}], "sourceIdentifier": "ykramarz@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-425"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-285"}], "source": "ykramarz@cisco.com", "type": "Secondary"}]}