CVE-2019-15990 Cisco Small Business Routers RV016, RV042, RV042G, and RV082 Information Disclosure Vulnerability
Unauthenticated remote attackers can view sensitive information in the web management interface of Cisco Small Business Routers due to improper authorization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-15990?
CVE-2019-15990 is a medium-severity missing authorization vulnerability in Cisco Small Business RV Series Router Firmware, published on 26 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an unauthenticated, remote attacker to view information displayed in the web-based management interface. The vulnerability is due to improper authorization of HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to view information displayed in the web-based management interface without authentication.
Weakness: CWE-285
Which versions are affected by CVE-2019-15990?
It affects 4 products.
Products include Cisco Rv016 Multi-Wan Vpn Firmware, Cisco Rv042 Dual Wan Vpn Firmware, Cisco Rv042g Dual Gigabit Wan Vpn Firmware, Cisco Rv082 Dual Wan Vpn Firmware.
How do I fix CVE-2019-15990?
No fix has been published for CVE-2019-15990 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-15990 being exploited?
There is no known exploitation of CVE-2019-15990 in the wild and no public exploit code.
Other vulnerabilities in Cisco Small Business RV Series Router Firmware
Sources
Also known as GHSA-89q8-rgqc-jpf8.