CWE Code: 20
Vulnerability Type: privilege_escalation
CVSS Score: 10.0
CWE Name:  Improper Input Validation
Summary: a vulnerability in the web-based management interface of the cisco rv110w wireless-n vpn firewall, cisco rv130w wireless-n multifunction vpn router, and cisco rv215w wireless-n vpn router could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. the vulnerability is due to improper validation of user-supplied data in the web-based management interface. an attacker could exploit this vulnerability by sending malicious http requests to a targeted device. a successful exploit could allow the attacker to execute arbitrary code on the underlying operating system of the affected device as a high-privilege user. rv110w wireless-n vpn firewall versions prior to 1.2.2.1 are affected. rv130w wireless-n multifunction vpn router versions prior to 1.0.3.45 are affected. rv215w wireless-n vpn router versions prior to 1.3.1.1 are affected.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2019-02-28
Last Modified Date: 2019-06-04