Vulnerability Details : CVE-2018-0423
A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to cause a denial of service condition or to execute arbitrary code. The vulnerability is due to improper boundary restrictions on user-supplied input in the Guest user feature of the web-based management interface. An attacker could exploit this vulnerability by sending malicious requests to a targeted device, triggering a buffer overflow condition. A successful exploit could allow the attacker to cause the device to stop responding, resulting in a denial of service condition, or could allow the attacker to execute arbitrary code.
Vulnerability category: OverflowExecute codeDenial of service
Products affected by CVE-2018-0423
- cpe:2.3:o:cisco:rv110w_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:rv215w_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:rv130w_firmware:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-0423
3.94%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 88 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-0423
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST | |
8.1
|
HIGH | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
2.2
|
5.9
|
NIST |
CWE ids for CVE-2018-0423
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by:
- nvd@nist.gov (Primary)
- ykramarz@cisco.com (Secondary)
References for CVE-2018-0423
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-rv-routers-overflow
Cisco RV110W, RV130W, and RV215W Routers Management Interface Buffer Overflow VulnerabilityVendor Advisory
-
http://www.securityfocus.com/bid/105285
Cisco RV110W/RV130W/RV215W Routers Management Interface CVE-2018-0423 Buffer Overflow VulnerabilityThird Party Advisory;VDB Entry
-
http://www.securitytracker.com/id/1041675
Cisco Small Business RV Series Buffer Overflow Lets Remote Users Execute Arbitrary Code - SecurityTrackerThird Party Advisory;VDB Entry
Jump to