Details of VAR-202207-1582

ID

VAR-202207-1582

CVE

CVE-2022-20881

TITLE

plural Cisco In the product OS Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2022-015443

DESCRIPTION

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly, resulting in a denial of service (DoS) condition. These vulnerabilities are due to insufficient validation of user fields within incoming HTTP packets. An attacker could exploit these vulnerabilities by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on an affected device with root-level privileges or to cause the device to restart unexpectedly, resulting in a DoS condition. To exploit these vulnerabilities, an attacker would need to have valid Administrator credentials on the affected device. Cisco has not released software updates that address these vulnerabilities. plural Cisco The product has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Cisco Small Business is a switch of Cisco (Cisco)

Trust: 1.71

sources: NVD: CVE-2022-20881 // JVNDB: JVNDB-2022-015443 // VULHUB: VHN-405434

AFFECTED PRODUCTS

vendor:	cisco	model:	application extension platform	scope:	eq	version:	1.0.3.55	Trust: 1.0
vendor:	cisco	model:	rv215w	scope:	eq	version:	1.0.3.55	Trust: 1.0
vendor:	cisco	model:	rv130	scope:	eq	version:	1.0.3.55	Trust: 1.0
vendor:	cisco	model:	rv110w	scope:	eq	version:	1.0.3.55	Trust: 1.0
vendor:	cisco	model:	rv130w	scope:	eq	version:	1.0.3.55	Trust: 1.0
vendor:	シスコシステムズ	model:	cisco rv110w wireless-n vpn firewall	scope:	-	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	rv130 vpn ルータ	scope:	-	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	cisco rv215w wireless-n vpn ルータ	scope:	-	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	application extension platform	scope:	-	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	cisco rv130w wireless-n multifunction vpn ルータ	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2022-015443 // NVD: CVE-2022-20881

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2022-20881
value:	HIGH
Trust: 1.0
ykramarz@cisco.com:	CVE-2022-20881
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2022-20881
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202207-2150
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2022-20881
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.1
Trust: 1.0
ykramarz@cisco.com:	CVE-2022-20881
baseSeverity:	MEDIUM
baseScore:	4.7
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	1.2
impactScore:	3.4
version:	3.1
Trust: 1.0
NVD:	CVE-2022-20881
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2022-015443 // CNNVD: CNNVD-202207-2150 // NVD: CVE-2022-20881 // NVD: CVE-2022-20881

PROBLEMTYPE DATA

problemtype:	CWE-78	Trust: 1.1
problemtype:	CWE-120	Trust: 1.0
problemtype:	OS Command injection (CWE-78) [NVD evaluation ]	Trust: 0.8

sources: VULHUB: VHN-405434 // JVNDB: JVNDB-2022-015443 // NVD: CVE-2022-20881

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202207-2150

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202207-2150

PATCH

title:	cisco-sa-sb-rv-rce-overflow-ygHByAK	url:	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv-rce-overflow-ygHByAK	Trust: 0.8
title:	Cisco Small Business Fixes for operating system command injection vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=201522	Trust: 0.6

sources: JVNDB: JVNDB-2022-015443 // CNNVD: CNNVD-202207-2150

EXTERNAL IDS

db:	NVD	id:	CVE-2022-20881	Trust: 3.3
db:	JVNDB	id:	JVNDB-2022-015443	Trust: 0.8
db:	CNNVD	id:	CNNVD-202207-2150	Trust: 0.7
db:	CS-HELP	id:	SB2022072215	Trust: 0.6
db:	VULHUB	id:	VHN-405434	Trust: 0.1

sources: VULHUB: VHN-405434 // JVNDB: JVNDB-2022-015443 // CNNVD: CNNVD-202207-2150 // NVD: CVE-2022-20881

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-sb-rv-rce-overflow-yghbyak	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2022-20881	Trust: 0.8
url:	https://www.cybersecurity-help.cz/vdb/sb2022072215	Trust: 0.6
url:	https://cxsecurity.com/cveshow/cve-2022-20881/	Trust: 0.6

sources: VULHUB: VHN-405434 // JVNDB: JVNDB-2022-015443 // CNNVD: CNNVD-202207-2150 // NVD: CVE-2022-20881

SOURCES

db:	VULHUB	id:	VHN-405434
db:	JVNDB	id:	JVNDB-2022-015443
db:	CNNVD	id:	CNNVD-202207-2150
db:	NVD	id:	CVE-2022-20881

LAST UPDATE DATE

2024-08-14T13:22:00.038000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-405434	date:	2022-07-26T00:00:00
db:	JVNDB	id:	JVNDB-2022-015443	date:	2023-09-27T06:42:00
db:	CNNVD	id:	CNNVD-202207-2150	date:	2022-07-27T00:00:00
db:	NVD	id:	CVE-2022-20881	date:	2023-11-07T03:43:12.400

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-405434	date:	2022-07-21T00:00:00
db:	JVNDB	id:	JVNDB-2022-015443	date:	2023-09-27T00:00:00
db:	CNNVD	id:	CNNVD-202207-2150	date:	2022-07-21T00:00:00
db:	NVD	id:	CVE-2022-20881	date:	2022-07-21T05:15:07.067