10
CVSSv2

CVE-2015-6319

Published: 27/01/2016 Updated: 07/12/2016
CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 890
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Summary

SQL injection vulnerability in the web-based management interface on Cisco RV220W devices allows remote malicious users to execute arbitrary SQL commands via a crafted header in an HTTP request, aka Bug ID CSCuv29574.

Vulnerable Product Search on Vulmon Subscribe to Product

cisco rv_series_router_firmware 1.0.6.6

cisco rv_series_router_firmware 1.0.5.8

cisco rv_series_router_firmware 1.0.1.9

cisco rv_series_router_firmware 1.0.0.30

cisco rv_series_router_firmware 1.0.4.14

cisco rv_series_router_firmware 1.0.4.10

cisco rv_series_router_firmware 1.0.5.6

cisco rv_series_router_firmware 1.0.5.4.\\\\\\(gd\\\\\\)

cisco rv_series_router_firmware 1.0.0.2

cisco rv_series_router_firmware 1.2.0.2

cisco rv_series_router_firmware 1.1.0.9

cisco rv_series_router_firmware 1.0.3.10

cisco rv_series_router_firmware 1.0.2.6

Vendor Advisories

A vulnerability in the web-based management interface of Cisco RV220W Wireless Network Security Firewall devices could allow an unauthenticated, remote attacker to bypass authentication and gain administrative privileges on a targeted device The vulnerability is due to insufficient input validation of HTTP request headers that are sent to the web ...