CVE-2011-1647

The web management interface on the Cisco RVS4000 Gigabit Security Router with software 1.x before 1.3.3.4 and 2.x before 2.0.2.7, and the WRVS4400N Gigabit Security Router with software before 2.0.2.1, allows remote attackers to read the private key for the admin SSL certificate via unspecified vectors, aka Bug ID CSCtn23871.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b7f190.shtml	Vendor Advisory
http://www.securityfocus.com/bid/47985
http://www.securitytracker.com/id?1025565

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:h:cisco:rvs4000:1:::::::*
	cpe:2.3:h:cisco:rvs4000:2:::::::*

OR	cpe:2.3:a:cisco:rvs4000_software:1.3.0.5:::::::*
	cpe:2.3:a:cisco:rvs4000_software:1.3.1.0:::::::*
	cpe:2.3:a:cisco:rvs4000_software:1.3.2.0:::::::*
	cpe:2.3:a:cisco:rvs4000_software:2.0.0.3:::::::*

Configuration 2 (hide)

AND

OR	cpe:2.3:h:cisco:wrvs4400n:1.0:::::::*
	cpe:2.3:h:cisco:wrvs4400n:1.1:::::::*
	cpe:2.3:h:cisco:wrvs4400n:2:::::::*

OR	cpe:2.3:a:cisco:wrvs4400n_software:1.3.0.5:::::::*
	cpe:2.3:a:cisco:wrvs4400n_software:1.3.1.0:::::::*
	cpe:2.3:a:cisco:wrvs4400n_software:1.3.2.0:::::::*
	cpe:2.3:a:cisco:wrvs4400n_software:2.0.0.3:::::::*

History

No history.

Information

Published : 2011-05-31 20:55

Updated : 2024-02-04 17:54

NVD link : CVE-2011-1647

Mitre link : CVE-2011-1647

CVE.ORG link : CVE-2011-1647

JSON object : View

Products Affected

cisco

rvs4000_software
wrvs4400n_software
wrvs4400n
rvs4000

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2011-1647", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2011-05-31T20:55:02.827", "references": [{"url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b7f190.shtml", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securityfocus.com/bid/47985", "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id?1025565", "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The web management interface on the Cisco RVS4000 Gigabit Security Router with software 1.x before 1.3.3.4 and 2.x before 2.0.2.7, and the WRVS4400N Gigabit Security Router with software before 2.0.2.1, allows remote attackers to read the private key for the admin SSL certificate via unspecified vectors, aka Bug ID CSCtn23871."}, {"lang": "es", "value": "El interfaz de administraci\u00f3n web de Cisco RVS4000 Gigabit Security Router con software 1.x anteriores a 1.3.3.4 y 2.x anteriores a 2.0.2.7, y de WRVS4400N Gigabit Security Router con software anterior a la versi\u00f3n 2.0.2.1 permite a atacantes remotos leer la clave privada del certificado SSL admin a trav\u00e9s de vectores sin especificar. Tambi\u00e9n conocido como Bug ID CSCtn23871."}], "lastModified": "2011-09-07T03:16:18.707", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:rvs4000:1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BDEB65FB-54C5-4574-9208-F3E3EE823B96"}, {"criteria": "cpe:2.3:h:cisco:rvs4000:2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF7E4042-1F62-4DF7-A624-2F492F792937"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:rvs4000_software:1.3.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5363CFAF-439E-488C-9E97-BE04D80A4F9D"}, {"criteria": "cpe:2.3:a:cisco:rvs4000_software:1.3.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "096FB511-0E5D-46B6-827B-EAB242E015EA"}, {"criteria": "cpe:2.3:a:cisco:rvs4000_software:1.3.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "567C5658-57F0-4BBA-9849-9A77504102FC"}, {"criteria": "cpe:2.3:a:cisco:rvs4000_software:2.0.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2596081A-DFA3-4006-9B7C-EE3A29ED0341"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:wrvs4400n:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D9D4BF4B-0360-4A3B-8843-1D5E84CA948E"}, {"criteria": "cpe:2.3:h:cisco:wrvs4400n:1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7C01433D-F43E-4574-BC04-1F0C060BBFC4"}, {"criteria": "cpe:2.3:h:cisco:wrvs4400n:2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A3C11E2E-B910-45EC-A8FA-6BAAFFD26ED3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:wrvs4400n_software:1.3.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C754BA1B-7DEC-49F4-835F-1EDA9289E19D"}, {"criteria": "cpe:2.3:a:cisco:wrvs4400n_software:1.3.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A0606AC-B349-411A-8D45-213A60FCFD08"}, {"criteria": "cpe:2.3:a:cisco:wrvs4400n_software:1.3.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1CE7344-400B-4E2F-B9DF-C2B0BB74B080"}, {"criteria": "cpe:2.3:a:cisco:wrvs4400n_software:2.0.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BEB82F7E-A77E-400A-B894-3207026826C9"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ykramarz@cisco.com"}