CWE Code: 20
Vulnerability Type: privilege_escalation
CVSS Score: 9.0
CWE Name:  Improper Input Validation
Summary: a vulnerability in the web management interface of cisco small business 220 series smart switches could allow an authenticated, remote attacker to perform a command injection attack. the vulnerability is due to insufficient validation of user-supplied input. an attacker could exploit this vulnerability by sending a malicious request to certain parts of the web management interface. to send the malicious request, the attacker needs a valid login session in the web management interface as a privilege level 15 user. depending on the configuration of the affected switch, the malicious request must be sent via http or https. a successful exploit could allow the attacker to execute arbitrary shell commands with the privileges of the root user.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2019-08-07
Last Modified Date: 2019-10-01