Vulnerability Details : CVE-2014-2179
The Cisco RV router firmware on RV220W devices, before 1.0.5.9 on RV120W devices, and before 1.0.4.14 on RV180 and RV180W devices allows remote attackers to upload files to arbitrary locations via a crafted HTTP request, aka Bug ID CSCuh86998.
Vulnerability category: Input validation
Products affected by CVE-2014-2179
- cpe:2.3:o:cisco:rv220w_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:rv220w:-:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:rv180_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:rv180:-:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:rv180w:-:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:rv120w_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:rv120w:-:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-2179
0.33%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 71 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-2179
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2014-2179
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-2179
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/98499
Multiple Cisco routers file upload CVE-2014-2179 Vulnerability Report
-
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141105-rv
Multiple Vulnerabilities in Cisco Small Business RV Series RoutersPatch;Vendor Advisory
-
http://www.securityfocus.com/archive/1/533917/100/0/threaded
SecurityFocus
-
http://www.securitytracker.com/id/1031171
Cisco Small Business RV Series Router Bugs Let Remote Users Upload Arbitrary Files and Remote Authenticated Users Execute Arbitrary Commands Permits Cross-Site Scripting Attacks - SecurityTracker
-
http://seclists.org/fulldisclosure/2014/Nov/6
Full Disclosure: Cisco RV Series multiple vulnerabilities
-
http://packetstormsecurity.com/files/128992/Cisco-RV-Overwrite-CSRF-Command-Execution.html
Cisco RV Overwrite / CSRF / Command Execution ≈ Packet Storm
Jump to