Sign-up

ID

VAR-201411-0402


CVE

CVE-2014-2179


TITLE

Cisco RV Router Vulnerability in uploading files to arbitrary locations in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2014-005296

DESCRIPTION

The Cisco RV router firmware on RV220W devices, before 1.0.5.9 on RV120W devices, and before 1.0.4.14 on RV180 and RV180W devices allows remote attackers to upload files to arbitrary locations via a crafted HTTP request, aka Bug ID CSCuh86998. Vendors have confirmed this vulnerability Bug ID CSCuh86998 It is released as.Skillfully crafted by a third party HTTP A file may be uploaded to any location via a request. An attacker could exploit this vulnerability to upload arbitrary files. This issue is being tracked by Cisco Bug ID CSCuh86998. are all products of Cisco (Cisco). ------------------------------------------------------------------------ Details ------------------------------------------------------------------------ https://www.securify.nl/advisory/SFY20130601/cisco_rv_series_multiple_vulnerabilities.html ------------------------------------------------------------------------ References ------------------------------------------------------------------------ [1] http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2177 [2] http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2178 [3] http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2179 [4] http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141105-rv

Trust: 2.61

sources: NVD: CVE-2014-2179 // JVNDB: JVNDB-2014-005296 // CNVD: CNVD-2014-08189 // BID: 70920 // VULHUB: VHN-70118 // PACKETSTORM: 128992

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2014-08189

AFFECTED PRODUCTS

vendor:ciscomodel:rv220w wireless network security firewallscope: - version: -

Trust: 1.6

vendor:ciscomodel:rv120wscope:eqversion:1.0.5.8

Trust: 1.2

vendor:ciscomodel:rv120wscope:eqversion: -

Trust: 1.0

vendor:ciscomodel:rv180scope:lteversion:1.0.3.10

Trust: 1.0

vendor:ciscomodel:rv220wscope:lteversion:1.0.5.8

Trust: 1.0

vendor:ciscomodel:rv180scope:eqversion: -

Trust: 1.0

vendor:ciscomodel:rv180wscope:eqversion: -

Trust: 1.0

vendor:ciscomodel:rv120wscope:lteversion:1.0.5.8

Trust: 1.0

vendor:ciscomodel:rv220wscope:eqversion: -

Trust: 1.0

vendor:ciscomodel:rv120w wireless-n vpn firewallscope: - version: -

Trust: 0.8

vendor:ciscomodel:rv120w wireless-n vpn firewallscope:ltversion:1.0.5.9

Trust: 0.8

vendor:ciscomodel:rv180 vpn routerscope: - version: -

Trust: 0.8

vendor:ciscomodel:rv180 vpn routerscope:ltversion:1.0.4.14

Trust: 0.8

vendor:ciscomodel:rv180w wireless-n multifunction vpn routerscope: - version: -

Trust: 0.8

vendor:ciscomodel:rv180scope:lteversion:<=1.0.3.10

Trust: 0.6

vendor:ciscomodel:rv220wscope:lteversion:<=1.0.5.8

Trust: 0.6

vendor:ciscomodel:rv220wscope:eqversion:1.0.5.8

Trust: 0.6

vendor:ciscomodel:rv180scope:eqversion:1.0.3.10

Trust: 0.6

sources: CNVD: CNVD-2014-08189 // JVNDB: JVNDB-2014-005296 // CNNVD: CNNVD-201411-101 // NVD: CVE-2014-2179

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-2179
value: MEDIUM

Trust: 1.0

NVD: CVE-2014-2179
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2014-08189
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201411-101
value: MEDIUM

Trust: 0.6

VULHUB: VHN-70118
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2014-2179
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2014-08189
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-70118
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CNVD: CNVD-2014-08189 // VULHUB: VHN-70118 // JVNDB: JVNDB-2014-005296 // CNNVD: CNNVD-201411-101 // NVD: CVE-2014-2179

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-70118 // JVNDB: JVNDB-2014-005296 // NVD: CVE-2014-2179

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201411-101

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201411-101

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-005296

PATCH
title:cisco-sa-20141105-rvurl:http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141105-rv
Trust: 0.8
title:36242url:http://tools.cisco.com/security/center/viewAlert.x?alertId=36242
Trust: 0.8
title:Cisco RV router firmware patch for arbitrary file upload vulnerabilitiesurl:https://www.cnvd.org.cn/patchInfo/show/51780
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2014-08189 // 
            
            
            
            JVNDB: JVNDB-2014-005296

EXTERNAL IDS
db:NVDid:CVE-2014-2179
Trust: 3.5
db:PACKETSTORMid:128992
Trust: 1.2
db:SECTRACKid:1031171
Trust: 1.1
db:JVNDBid:JVNDB-2014-005296
Trust: 0.8
db:CNNVDid:CNNVD-201411-101
Trust: 0.7
db:CNVDid:CNVD-2014-08189
Trust: 0.6
db:BIDid:70920
Trust: 0.4
db:VULHUBid:VHN-70118
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2014-08189 // 
            
            
            
            VULHUB: VHN-70118 // 
            
            
            
            BID: 70920 // 
            
            
            
            JVNDB: JVNDB-2014-005296 // 
            
            
            
            PACKETSTORM: 128992 // 
            
            
            
            CNNVD: CNNVD-201411-101 // 
            
            
            
            NVD: CVE-2014-2179

REFERENCES
url:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20141105-rv
Trust: 1.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-2179
Trust: 1.5
url:http://www.securityfocus.com/archive/1/533917/100/0/threaded
Trust: 1.1
url:http://seclists.org/fulldisclosure/2014/nov/6
Trust: 1.1
url:http://packetstormsecurity.com/files/128992/cisco-rv-overwrite-csrf-command-execution.html
Trust: 1.1
url:http://www.securitytracker.com/id/1031171
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/98499
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2179
Trust: 0.8
url:http://www.cisco.com/
Trust: 0.3
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-2177
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-2177
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-2179
Trust: 0.1
url:https://www.securify.nl/advisory/sfy20130601/cisco_rv_series_multiple_vulnerabilities.html
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-2178
Trust: 0.1
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-2178
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2014-08189 // 
            
            
            
            VULHUB: VHN-70118 // 
            
            
            
            BID: 70920 // 
            
            
            
            JVNDB: JVNDB-2014-005296 // 
            
            
            
            PACKETSTORM: 128992 // 
            
            
            
            CNNVD: CNNVD-201411-101 // 
            
            
            
            NVD: CVE-2014-2179

CREDITS
Yorick Koster of Securify
Trust: 0.3
sources:
            
            
            BID: 70920

SOURCES
db:CNVDid:CNVD-2014-08189
db:VULHUBid:VHN-70118
db:BIDid:70920
db:JVNDBid:JVNDB-2014-005296
db:PACKETSTORMid:128992
db:CNNVDid:CNNVD-201411-101
db:NVDid:CVE-2014-2179

LAST UPDATE DATE
2024-11-23T22:31:12.533000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2014-08189date:2014-11-11T00:00:00
db:VULHUBid:VHN-70118date:2018-10-09T00:00:00
db:BIDid:70920date:2014-11-24T00:58:00
db:JVNDBid:JVNDB-2014-005296date:2014-11-10T00:00:00
db:CNNVDid:CNNVD-201411-101date:2014-11-14T00:00:00
db:NVDid:CVE-2014-2179date:2024-11-21T02:05:48.177

SOURCES RELEASE DATE
db:CNVDid:CNVD-2014-08189date:2014-11-11T00:00:00
db:VULHUBid:VHN-70118date:2014-11-07T00:00:00
db:BIDid:70920date:2014-11-05T00:00:00
db:JVNDBid:JVNDB-2014-005296date:2014-11-10T00:00:00
db:PACKETSTORMid:128992date:2014-11-06T12:02:22
db:CNNVDid:CNNVD-201411-101date:2014-11-14T00:00:00
db:NVDid:CVE-2014-2179date:2014-11-07T11:55:02.517