NetSight
IP …
medium5.3Public exploit code

CVE-2019-15993

A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information. The vulnerability exists because the software lacks proper authentication controls to information accessible from the web UI. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web UI of an affected device. A successful exploit could allow the attacker to access sensitive device information, which includes configuration files.

Affected products

VendorProductAffected versions
CiscoSg250x-24 Firmware
before 2.5.0.92
CiscoSg250x-24p Firmware
before 2.5.0.92
CiscoSg250x-48 Firmware
before 2.5.0.92
CiscoSg250x-48p Firmware
before 2.5.0.92
CiscoSg250-08 Firmware
before 2.5.0.92
CiscoSg250-08hp Firmware
before 2.5.0.92
CiscoSg250-10p Firmware
before 2.5.0.92
CiscoSg250-18 Firmware
before 2.5.0.92
CiscoSg250-26 Firmware
before 2.5.0.92
CiscoSg250-26hp Firmware
before 2.5.0.92
CiscoSg250-26p Firmware
before 2.5.0.92
CiscoSg250-50 Firmware
before 2.5.0.92

Weakness classification

CWE-16CWE-287

References