CVE-2015-6319

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-6319
SQL injection vulnerability in the web-based management interface on Cisco RV220W devices allows remote attackers to execute arbitrary SQL commands via a crafted header in an HTTP request, aka Bug ID CSCuv29574.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160127-rv220 Vendor Advisory
http://www.securitytracker.com/id/1034830
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:h:cisco:rv016_multi-wan_vpn_router:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv042_dual_wan_vpn_router:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv042g_dual_gigabit_wan_vpn_router:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv082_dual_wan_vpn_router:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv110w_wireless-n_vpn_firewall:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv120w_wireless-n_vpn_firewall:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv130_vpn_router:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv130w_wireless-n_multifunction_vpn_router:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv180_vpn_router:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv180w_wireless-n_multifunction_vpn_router:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv215w_wireless-n_vpn_router:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv220w_wireless_network_security_firewall:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv320_dual_gigabit_wan_vpn_router:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv320_dual_gigabit_wan_wf_vpn_router:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv325_dual_gigabit_wan_wf_vpn_router:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rv325_dual_wan_gigabit_vpn_router:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rvl200_4-port_ssl_ipsec_vpn_router:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:rvs4000_4-port_gigabit_security_router_-_vpn:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:wrv200_wireless-g_vpn_router_-_rangebooster:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:wrv210_wireless-g_vpn_router_-_rangebooster:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:wrvs4400n_wireless-n_gigabit_security_router_-_vpn_v2.0:*:*:*:*:*:*:*:*
OR cpe:2.3:o:cisco:rv_series_router_firmware:1.0.0.2:*:*:*:*:*:*:*
cpe:2.3:o:cisco:rv_series_router_firmware:1.0.0.30:*:*:*:*:*:*:*
cpe:2.3:o:cisco:rv_series_router_firmware:1.0.1.9:*:*:*:*:*:*:*
cpe:2.3:o:cisco:rv_series_router_firmware:1.0.2.6:*:*:*:*:*:*:*
cpe:2.3:o:cisco:rv_series_router_firmware:1.0.3.10:*:*:*:*:*:*:*
cpe:2.3:o:cisco:rv_series_router_firmware:1.0.4.10:*:*:*:*:*:*:*
cpe:2.3:o:cisco:rv_series_router_firmware:1.0.4.14:*:*:*:*:*:*:*
cpe:2.3:o:cisco:rv_series_router_firmware:1.0.5.6:*:*:*:*:*:*:*
cpe:2.3:o:cisco:rv_series_router_firmware:1.0.5.8:*:*:*:*:*:*:*
cpe:2.3:o:cisco:rv_series_router_firmware:1.0.6.6:*:*:*:*:*:*:*
cpe:2.3:o:cisco:rv_series_router_firmware:1.1.0.9:*:*:*:*:*:*:*
cpe:2.3:o:cisco:rv_series_router_firmware:1.2.0.2:*:*:*:*:*:*:*
cpe:2.3:o:sun:opensolaris:snv_124:*:sparc:*:*:*:*:*
History

No history.

Information

Published : 2016-01-27 22:59

Updated : 2024-02-04 18:53

NVD link : CVE-2015-6319

Mitre link : CVE-2015-6319

CVE.ORG link : CVE-2015-6319

JSON object : View

Products Affected

cisco

  • rvl200_4-port_ssl_ipsec_vpn_router
  • rv110w_wireless-n_vpn_firewall
  • rv215w_wireless-n_vpn_router
  • rv120w_wireless-n_vpn_firewall
  • wrv210_wireless-g_vpn_router_-_rangebooster
  • wrvs4400n_wireless-n_gigabit_security_router_-_vpn_v2.0
  • wrv200_wireless-g_vpn_router_-_rangebooster
  • rv130w_wireless-n_multifunction_vpn_router
  • rv325_dual_gigabit_wan_wf_vpn_router
  • rv130_vpn_router
  • rv320_dual_gigabit_wan_wf_vpn_router
  • rv082_dual_wan_vpn_router
  • rv320_dual_gigabit_wan_vpn_router
  • rv180_vpn_router
  • rv220w_wireless_network_security_firewall
  • rv042g_dual_gigabit_wan_vpn_router
  • rv016_multi-wan_vpn_router
  • rv042_dual_wan_vpn_router
  • rv325_dual_wan_gigabit_vpn_router
  • rvs4000_4-port_gigabit_security_router_-_vpn
  • rv_series_router_firmware
  • rv180w_wireless-n_multifunction_vpn_router

sun

  • opensolaris
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')