NetSight
IP …
critical9.1Public exploit code

CVE-2019-1912

A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote attacker to upload arb…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote attacker to upload arbitrary files. The vulnerability is due to incomplete authorization checks in the web management interface. An attacker could exploit this vulnerability by sending a malicious request to certain parts of the web management interface. Depending on the configuration of the affected switch, the malicious request must be sent via HTTP or HTTPS. A successful exploit could allow the attacker to modify the configuration of an affected device or to inject a reverse shell. This vulnerability affects Cisco Small Business 220 Series Smart Switches running firmware versions prior to 1.1.4.4 with the web management interface enabled. The web management interface is enabled via both HTTP and HTTPS by default.

Affected products

VendorProductAffected versions
CiscoSf-220-24 Firmware
before 1.1.4.4
CiscoSf220-24p Firmware
before 1.1.4.4
CiscoSf220-48 Firmware
before 1.1.4.4
CiscoSf220-48p Firmware
before 1.1.4.4
CiscoSg220-26 Firmware
before 1.1.4.4
CiscoSg220-26p Firmware
before 1.1.4.4
CiscoSg220-28 Firmware
before 1.1.4.4
CiscoSg220-28mp Firmware
before 1.1.4.4
CiscoSg220-50 Firmware
before 1.1.4.4
CiscoSg220-50p Firmware
before 1.1.4.4
CiscoSg220-52 Firmware
before 1.1.4.4

Weakness classification

CWE-285CWE-863

References