CVE-2018-0405

A vulnerability in the web framework code for Cisco RV180W Wireless-N Multifunction VPN Router and Small Business RV Series RV220W Wireless Network Security Firewall could allow an unauthenticated, remote attacker to conduct a directory path traversal attack on a targeted device. The issue is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk28019	Vendor Advisory
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk28019	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:cisco:rv180w_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:rv180w:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:cisco:rv220w_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:rv220w:-:*:*:*:*:*:*:*

History

21 Nov 2024, 03:38

Type	Values Removed	Values Added
References	~~() https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk28019 - Vendor Advisory~~	() https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk28019 - Vendor Advisory

Information

Published : 2018-10-05 17:29

Updated : 2024-11-21 03:38

NVD link : CVE-2018-0405

Mitre link : CVE-2018-0405

CVE.ORG link : CVE-2018-0405

JSON object : View

Products Affected

cisco

rv180w_firmware
rv220w_firmware
rv180w
rv220w

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2018-0405", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-10-05T17:29:00.277", "references": [{"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk28019", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk28019", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web framework code for Cisco RV180W Wireless-N Multifunction VPN Router and Small Business RV Series RV220W Wireless Network Security Firewall could allow an unauthenticated, remote attacker to conduct a directory path traversal attack on a targeted device. The issue is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location."}, {"lang": "es", "value": "Una vulnerabilidad en el c\u00f3digo framework web para Cisco RV180W Wireless-N Multifunction VPN Router y Small Business RV Series RV220W Wireless Network Security Firewall podr\u00eda permitir que un atacante remoto realice un ataque de salto de directorio en un dispositivo objetivo. Este problema se debe al saneamiento incorrecto de las entradas proporcionadas por el usuario en par\u00e1metros de peticiones HTTP que describen nombres de archivo. Un atacante podr\u00eda explotar esta vulnerabilidad empleando t\u00e9cnicas de salto de directorio para enviar una ruta a la localizaci\u00f3n de archivo que prefiera."}], "lastModified": "2024-11-21T03:38:09.590", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:rv180w_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3D4116FE-D526-4FC6-9BFC-31155D467ADE"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:rv180w:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C5E3FBF6-4EB3-4C2F-AE0E-25F5765DD107"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:rv220w_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A2FA50FE-0C86-4C7D-B6EF-5A0BF1989DD5"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:rv220w:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8620DFD9-E280-464E-91FF-2E901EDD49C0"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ykramarz@cisco.com"}