Vulnerability Details : CVE-2017-3882
A vulnerability in the Universal Plug-and-Play (UPnP) implementation in the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, Layer 2-adjacent attacker to execute arbitrary code or cause a denial of service (DoS) condition. The remote code execution could occur with root privileges. The vulnerability is due to incomplete range checks of the UPnP input data, which could result in a buffer overflow. An attacker could exploit this vulnerability by sending a malicious request to the UPnP listening port of the targeted device. An exploit could allow the attacker to cause the device to reload or potentially execute arbitrary code with root privileges. This vulnerability affects all firmware releases of the Cisco CVR100W Wireless-N VPN Router prior to Firmware Release 1.0.1.22. Cisco Bug IDs: CSCuz72642.
Vulnerability category: OverflowExecute codeDenial of service
Products affected by CVE-2017-3882
- cpe:2.3:a:cisco:small_business_rv_router_firmware_1.0:0.2:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:small_business_rv_router_firmware:1.0.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:small_business_rv_router_firmware:1.0.6.6:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:small_business_rv_router_firmware:1.0.5.6:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:small_business_rv_router_firmware:1.0.39:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:small_business_rv_router_firmware:1.0.1.9:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:small_business_rv_router_firmware:1.0.4.14:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:small_business_rv_router_firmware:1.0.0.30:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:small_business_rv_router_firmware:1.0.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:small_business_rv_router_firmware:1.0.1.19:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:small_business_rv_router_firmware:1.0.3.10:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:small_business_rv_router_firmware:1.0.4.10:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:small_business_rv_router_firmware:1.0.5.5:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:small_business_rv_router_firmware:1.0.5.8:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:small_business_rv_router_firmware:1.0.5.4\(gd\):*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-3882
0.97%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 83 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-3882
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
8.3
|
HIGH | AV:A/AC:L/Au:N/C:C/I:C/A:C |
6.5
|
10.0
|
NIST | |
9.6
|
CRITICAL | CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
2.8
|
6.0
|
NIST |
CWE ids for CVE-2017-3882
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by:
- nvd@nist.gov (Primary)
- ykramarz@cisco.com (Secondary)
References for CVE-2017-3882
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170503-cvr100w1
Cisco CVR100W Wireless-N VPN Router Universal Plug-and-Play Buffer Overflow VulnerabilityVendor Advisory
-
http://www.securityfocus.com/bid/98287
Cisco CVR100W Wireless-N VPN Router CVE-2017-3882 Buffer Overflow VulnerabilityThird Party Advisory;VDB Entry
-
http://www.securitytracker.com/id/1038391
Cisco CVR100W Wireless-N VPN Router Buffer Overflow in UPnP Lets Remote Users on the Local Network Execute Arbitrary Code - SecurityTracker
Jump to