CVE-2019-15993 - Cisco Small Business Switches Information Disclosure Vulnerability

Back Back to CVE browser

MEDIUM

Cisco Small Business Switches Information Disclosure Vulnerability

Published Sep 23, 2020

5.3

MEDIUM

CVSS 3.1

EPSS 10.27%

Description

A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information. The vulnerability exists because the software lacks proper authentication controls to information accessible from the web UI. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web UI of an affected device. A successful exploit could allow the attacker to access sensitive device information, which includes configuration files.

Affected products

Vendor Cisco Product Cisco Small Business 250 Series Smart Switches Software Default
n/a

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cisco

Cisco Small Business 250 Series Smart Switches Software

n/a

Version	Status	Constraints

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-16

CWE-287

Improper Authentication

References (2)

Link	Providers	Tags
http://packetstormsecurity.com/files/171723/Cisco-Dell-Netgear-Information-Disclosure-Hash-Decrypter.html
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200129-smlbus-switch-disclos		vendor-advisoryVendor Advisory