ID

VAR-202006-1120


CVE

CVE-2020-3279


TITLE

plural Cisco Small Business RV In series routers OS Command injection vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2020-006859

DESCRIPTION

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, and RV082 Routers could allow an authenticated, remote attacker with administrative privileges to execute arbitrary commands on an affected device. The vulnerabilities exist because the web-based management interface does not properly validate user-supplied input to scripts. An attacker with administrative privileges that are sufficient to log in to the web-based management interface could exploit each vulnerability by sending malicious requests to an affected device. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying operating system. (DoS) It may be put into a state. Cisco Small Business RV320, etc. are all a VPN router of Cisco in the United States. There are command injection vulnerabilities in the web management interface in many Cisco products. The vulnerability stems from the program's failure to properly verify the input submitted by the user

Trust: 2.25

sources: NVD: CVE-2020-3279 // JVNDB: JVNDB-2020-006859 // CNVD: CNVD-2020-35159 // VULMON: CVE-2020-3279

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2020-35159

AFFECTED PRODUCTS

vendor:ciscomodel:rv320scope:lteversion:1.5.1.05

Trust: 1.0

vendor:ciscomodel:rv042gscope:lteversion:4.2.3.10

Trust: 1.0

vendor:ciscomodel:rv042scope:lteversion:4.2.3.10

Trust: 1.0

vendor:ciscomodel:rv082scope:lteversion:4.2.3.10

Trust: 1.0

vendor:ciscomodel:rv016scope:lteversion:4.2.3.10

Trust: 1.0

vendor:ciscomodel:rv325scope:lteversion:1.5.1.05

Trust: 1.0

vendor:ciscomodel:rv320 dual gigabit wan vpn routerscope: - version: -

Trust: 0.8

vendor:ciscomodel:rv325 dual gigabit wan vpn routerscope: - version: -

Trust: 0.8

vendor:ciscomodel:rv016 multi-wan vpnscope: - version: -

Trust: 0.8

vendor:ciscomodel:rv042 dual wan vpnscope: - version: -

Trust: 0.8

vendor:ciscomodel:rv042g dual gigabit wan vpnscope: - version: -

Trust: 0.8

vendor:ciscomodel:rv082 dual wan vpnscope: - version: -

Trust: 0.8

vendor:ciscomodel:small business rv016 multi-wan vpnscope:lteversion:<=4.2.3.10

Trust: 0.6

vendor:ciscomodel:rv042 dual wan vpnscope:lteversion:<=4.2.3.10

Trust: 0.6

vendor:ciscomodel:rv042g dual gigabit wan vpnscope:lteversion:<=4.2.3.10

Trust: 0.6

vendor:ciscomodel:rv082 dual wan vpnscope:lteversion:<=4.2.3.10

Trust: 0.6

vendor:ciscomodel:rv320 dual gigabit wan vpnscope:lteversion:<=1.5.1.05

Trust: 0.6

vendor:ciscomodel:rv325 dual gigabit wan vpnscope:lteversion:<=1.5.1.05

Trust: 0.6

sources: CNVD: CNVD-2020-35159 // JVNDB: JVNDB-2020-006859 // NVD: CVE-2020-3279

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-3279
value: HIGH

Trust: 1.0

ykramarz@cisco.com: CVE-2020-3279
value: HIGH

Trust: 1.0

NVD: JVNDB-2020-006859
value: HIGH

Trust: 0.8

CNVD: CNVD-2020-35159
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202006-1149
value: HIGH

Trust: 0.6

VULMON: CVE-2020-3279
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2020-3279
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

NVD: JVNDB-2020-006859
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2020-35159
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2020-3279
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.9
version: 3.1

Trust: 1.0

ykramarz@cisco.com: CVE-2020-3279
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.9
version: 3.0

Trust: 1.0

NVD: JVNDB-2020-006859
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2020-35159 // VULMON: CVE-2020-3279 // JVNDB: JVNDB-2020-006859 // CNNVD: CNNVD-202006-1149 // NVD: CVE-2020-3279 // NVD: CVE-2020-3279

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.8

problemtype:CWE-77

Trust: 1.0

sources: JVNDB: JVNDB-2020-006859 // NVD: CVE-2020-3279

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202006-1149

TYPE

command injection

Trust: 0.6

sources: CNNVD: CNNVD-202006-1149

CONFIGURATIONS

sources: JVNDB: JVNDB-2020-006859

PATCH

title:cisco-sa-rv-routers-Rj5JRfF8url:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-routers-Rj5JRfF8

Trust: 0.8

title:Patch for Multiple Cisco product command injection vulnerabilities (CNVD-2020-35159)url:https://www.cnvd.org.cn/patchInfo/show/223655

Trust: 0.6

title:Multiple Cisco Product Command Injection Vulnerability Fixesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=123001

Trust: 0.6

title:Cisco: Cisco Small Business RV Series Routers Command Injection Vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-rv-routers-Rj5JRfF8

Trust: 0.1

sources: CNVD: CNVD-2020-35159 // VULMON: CVE-2020-3279 // JVNDB: JVNDB-2020-006859 // CNNVD: CNNVD-202006-1149

EXTERNAL IDS

db:NVDid:CVE-2020-3279

Trust: 3.1

db:JVNDBid:JVNDB-2020-006859

Trust: 0.8

db:CNVDid:CNVD-2020-35159

Trust: 0.6

db:CNNVDid:CNNVD-202006-1149

Trust: 0.6

db:VULMONid:CVE-2020-3279

Trust: 0.1

sources: CNVD: CNVD-2020-35159 // VULMON: CVE-2020-3279 // JVNDB: JVNDB-2020-006859 // CNNVD: CNNVD-202006-1149 // NVD: CVE-2020-3279

REFERENCES

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-rv-routers-rj5jrff8

Trust: 2.3

url:https://nvd.nist.gov/vuln/detail/cve-2020-3279

Trust: 1.4

url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-3279

Trust: 0.8

url:https://cwe.mitre.org/data/definitions/78.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/183584

Trust: 0.1

sources: CNVD: CNVD-2020-35159 // VULMON: CVE-2020-3279 // JVNDB: JVNDB-2020-006859 // CNNVD: CNNVD-202006-1149 // NVD: CVE-2020-3279

CREDITS

Kai Cheng

Trust: 0.6

sources: CNNVD: CNNVD-202006-1149

SOURCES

db:CNVDid:CNVD-2020-35159
db:VULMONid:CVE-2020-3279
db:JVNDBid:JVNDB-2020-006859
db:CNNVDid:CNNVD-202006-1149
db:NVDid:CVE-2020-3279

LAST UPDATE DATE

2024-08-14T13:44:07.350000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2020-35159date:2020-07-01T00:00:00
db:VULMONid:CVE-2020-3279date:2020-06-23T00:00:00
db:JVNDBid:JVNDB-2020-006859date:2020-07-21T00:00:00
db:CNNVDid:CNNVD-202006-1149date:2020-07-03T00:00:00
db:NVDid:CVE-2020-3279date:2020-06-23T17:24:40.587

SOURCES RELEASE DATE

db:CNVDid:CNVD-2020-35159date:2020-06-30T00:00:00
db:VULMONid:CVE-2020-3279date:2020-06-18T00:00:00
db:JVNDBid:JVNDB-2020-006859date:2020-07-21T00:00:00
db:CNNVDid:CNNVD-202006-1149date:2020-06-17T00:00:00
db:NVDid:CVE-2020-3279date:2020-06-18T03:15:12.637