CVE-2019-15993 Cisco Small Business Switches Information Disclosure Vulnerability

2020-09-2300:26:59

CWE-16

cisco

www.cve.org

cisco

small business

switches

information disclosure

vulnerability

web ui

unauthenticated

remote attacker

sensitive device information

authentication controls

http request

configuration files

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

50.5%

JSON

A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information. The vulnerability exists because the software lacks proper authentication controls to information accessible from the web UI. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web UI of an affected device. A successful exploit could allow the attacker to access sensitive device information, which includes configuration files.

CNA Affected

[
  {
    "vendor": "Cisco",
    "product": "Cisco Small Business 250 Series Smart Switches Software",
    "versions": [
      {
        "version": "n/a",
        "status": "affected"
      }
    ]
  }
]