Lucene search

K
nvd[email protected]NVD:CVE-2023-20025
HistoryJan 20, 2023 - 7:15 a.m.

CVE-2023-20025

2023-01-2007:15:14
CWE-20
CWE-293
web.nvd.nist.gov
4
cisco
rv042 series routers
web-based management
authentication bypass
remote attacker
root privileges
cve-2023-20025

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.003

Percentile

68.3%

A vulnerability in the web-based management interface of Cisco Small Business RV042 Series Routers could allow an unauthenticated, remote attacker to bypass authentication on the affected device.

This vulnerability is due to incorrect user input validation of incoming HTTP packets. An attacker could exploit this vulnerability by sending crafted requests to the web-based management interface. A successful exploit could allow the attacker to gain root privileges on the affected device.

Affected configurations

NVD
Node
ciscorv016_firmwareMatch-
AND
ciscorv016Match-
Node
ciscorv042Match-
AND
ciscorv042_firmwareMatch-
Node
ciscorv042gMatch-
AND
ciscorv042g_firmwareMatch-
Node
ciscorv082Match-
AND
ciscorv082_firmwareMatch-

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.003

Percentile

68.3%

Related for NVD:CVE-2023-20025