Details of VAR-202206-1301

ID

VAR-202206-1301

CVE

CVE-2022-20825

TITLE

plural Cisco Small Business Out-of-bounds write vulnerability in router products

Trust: 0.8

sources: JVNDB: JVNDB-2022-011650

DESCRIPTION

A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient user input validation of incoming HTTP packets. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on an affected device using root-level privileges. Cisco has not released software updates that address this vulnerability. plural Cisco Small Business Router products contain an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Cisco Small Business is a switch of Cisco (Cisco) in the United States

Trust: 2.25

sources: NVD: CVE-2022-20825 // JVNDB: JVNDB-2022-011650 // CNVD: CNVD-2022-55682 // VULMON: CVE-2022-20825

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2022-55682

AFFECTED PRODUCTS

vendor:	cisco	model:	rv130w	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	rv130	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	rv215w	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	rv110w	scope:	eq	version:	-	Trust: 1.0
vendor:	シスコシステムズ	model:	cisco rv130w wireless-n multifunction vpn ルータ	scope:	-	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	cisco rv215w wireless-n vpn ルータ	scope:	-	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	rv130 vpn ルータ	scope:	-	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	cisco rv110w wireless-n vpn firewall	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	rv110w	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	rv130w	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	rv215w	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	rv130	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2022-55682 // JVNDB: JVNDB-2022-011650 // NVD: CVE-2022-20825

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2022-20825
value:	CRITICAL
Trust: 1.8
ykramarz@cisco.com:	CVE-2022-20825
value:	CRITICAL
Trust: 1.0
CNVD:	CNVD-2022-55682
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-202206-1532
value:	CRITICAL
Trust: 0.6
VULMON:	CVE-2022-20825
value:	HIGH
Trust: 0.1

NVD:
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	FALSE
obtainAllPrivilege:	FALSE
obtainUserPrivilege:	FALSE
obtainOtherPrivilege:	FALSE
userInteractionRequired:	FALSE
version:	2.0
Trust: 1.0
NVD:	CVE-2022-20825
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.9
CNVD:	CNVD-2022-55682
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

NVD:
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 2.0
NVD:	CVE-2022-20825
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2022-55682 // VULMON: CVE-2022-20825 // JVNDB: JVNDB-2022-011650 // CNNVD: CNNVD-202206-1532 // NVD: CVE-2022-20825 // NVD: CVE-2022-20825

PROBLEMTYPE DATA

problemtype:	CWE-787	Trust: 1.0
problemtype:	Out-of-bounds writing (CWE-787) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2022-011650 // NVD: CVE-2022-20825

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202206-1532

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202206-1532

CONFIGURATIONS

sources: NVD: CVE-2022-20825

PATCH

title:	cisco-sa-sb-rv-overflow-s2r82P9v	url:	https://sec.cloudapps.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-sb-rv-overflow-s2r82p9v	Trust: 0.8
title:	Patch for Denial of Service Vulnerabilities in Multiple Cisco Small Business Products	url:	https://www.cnvd.org.cn/patchinfo/show/340056	Trust: 0.6
title:	Cisco Small Business Buffer error vulnerability fix	url:	http://123.124.177.30/web/xxk/bdxqbyid.tag?id=247274	Trust: 0.6
title:	Cisco: Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerability	url:	https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-sb-rv-overflow-s2r82p9v	Trust: 0.1
title:	CVE-2022-XXXX	url:	https://github.com/alphabugx/cve-2022-23305	Trust: 0.1
title:	CVE-2022-XXXX	url:	https://github.com/alphabugx/cve-2022-rce	Trust: 0.1

sources: CNVD: CNVD-2022-55682 // VULMON: CVE-2022-20825 // JVNDB: JVNDB-2022-011650 // CNNVD: CNNVD-202206-1532

EXTERNAL IDS

db:	NVD	id:	CVE-2022-20825	Trust: 3.9
db:	JVNDB	id:	JVNDB-2022-011650	Trust: 0.8
db:	CNVD	id:	CNVD-2022-55682	Trust: 0.6
db:	AUSCERT	id:	ESB-2022.2966	Trust: 0.6
db:	CNNVD	id:	CNNVD-202206-1532	Trust: 0.6
db:	VULMON	id:	CVE-2022-20825	Trust: 0.1

sources: CNVD: CNVD-2022-55682 // VULMON: CVE-2022-20825 // JVNDB: JVNDB-2022-011650 // CNNVD: CNNVD-202206-1532 // NVD: CVE-2022-20825

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-sb-rv-overflow-s2r82p9v	Trust: 3.0
url:	https://nvd.nist.gov/vuln/detail/cve-2022-20825	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2022-20825/	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2022.2966	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/787.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://github.com/alphabugx/cve-2022-23305	Trust: 0.1

sources: CNVD: CNVD-2022-55682 // VULMON: CVE-2022-20825 // JVNDB: JVNDB-2022-011650 // CNNVD: CNNVD-202206-1532 // NVD: CVE-2022-20825

SOURCES

db:	CNVD	id:	CNVD-2022-55682
db:	VULMON	id:	CVE-2022-20825
db:	JVNDB	id:	JVNDB-2022-011650
db:	CNNVD	id:	CNNVD-202206-1532
db:	NVD	id:	CVE-2022-20825

LAST UPDATE DATE

2024-02-13T01:53:10.109000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2022-55682	date:	2022-08-08T00:00:00
db:	VULMON	id:	CVE-2022-20825	date:	2023-11-07T00:00:00
db:	JVNDB	id:	JVNDB-2022-011650	date:	2023-08-23T07:09:00
db:	CNNVD	id:	CNNVD-202206-1532	date:	2023-07-25T00:00:00
db:	NVD	id:	CVE-2022-20825	date:	2023-11-07T03:43:03.907

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2022-55682	date:	2022-08-08T00:00:00
db:	VULMON	id:	CVE-2022-20825	date:	2022-06-15T00:00:00
db:	JVNDB	id:	JVNDB-2022-011650	date:	2023-08-23T00:00:00
db:	CNNVD	id:	CNNVD-202206-1532	date:	2022-06-15T00:00:00
db:	NVD	id:	CVE-2022-20825	date:	2022-06-15T18:15:09.173