CVE-2018-0423 Cisco RV110W, RV130W, and RV215W Routers Management Interface Buffer Overflow Vulnerability
Unauthenticated remote attackers can trigger a buffer overflow in the web management interface to execute arbitrary code or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-0423?
CVE-2018-0423 is a high-severity memory corruption vulnerability in Cisco Rv110w Firmware, published on 5 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to cause a denial of service condition or to execute arbitrary code. The vulnerability is due to improper boundary restrictions on user-supplied input in the Guest user feature of the web-based management interface. An attacker could exploit this vulnerability by sending malicious requests to a targeted device, triggering a buffer overflow condition. A successful exploit could allow the attacker to cause the device to stop responding, resulting in a denial of service condition, or could allow the attacker to execute arbitrary code.
Weakness: CWE-119
Which versions are affected by CVE-2018-0423?
It affects 3 products.
Products include Cisco Rv110w Firmware, Cisco Rv130w Firmware, Cisco Rv215w Firmware.
How do I fix CVE-2018-0423?
No fix has been published for CVE-2018-0423 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2018-0423 being exploited?
There is no known exploitation of CVE-2018-0423 in the wild and no public exploit code.
Other vulnerabilities in Cisco Rv110w Firmware
- CVE-2022-20825 Command injection in Cisco Small Business RV Series Router Firmware
- CVE-2021-1459 Command injection in Cisco Small Business RV Series Router Firmware
- CVE-2020-3144 Cisco RV110W, RV130, RV130W, and RV215W Routers Authentication Bypass Vulnerability
- CVE-2019-1663 Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
- CVE-2018-0425 Cisco RV110W, RV130W, and RV215W Routers Management Interface Information Disclosure Vulnerability
Sources
Also known as GHSA-3r77-vxv8-f245.