CVE-2019-1913 Cisco Small Business 220 Series Smart Switches Remote Code Execution Vulnerabilities
Unauthenticated remote attackers can execute arbitrary code with root privileges on Cisco Small Business 220 Series Smart Switches via buffer overflow in the web interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-1913?
CVE-2019-1913 is a critical memory corruption vulnerability in Cisco Small Business 220 Series Smart Plus Switches, published on 7 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple vulnerabilities in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote attacker to overflow a buffer, which then allows the execution of arbitrary code with root privileges on the underlying operating system. The vulnerabilities are due to insufficient validation of user-supplied input and improper boundary checks when reading data into an internal buffer. An attacker could exploit these vulnerabilities by sending malicious requests to the web management interface of an affected device. Depending on the configuration of the affected switch, the malicious requests must be sent via HTTP or HTTPS.
Weakness: CWE-119
Which versions are affected by CVE-2019-1913?
It affects 11 products.
Products include Cisco Sf-220-24 Firmware, Cisco Sf220-24p Firmware, Cisco Sf220-48 Firmware, Cisco Sf220-48p Firmware, Cisco Sg220-26 Firmware, Cisco Sg220-26p Firmware and 5 more.
How do I fix CVE-2019-1913?
No fix has been published for CVE-2019-1913 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2019-1913 being exploited?
There is no known exploitation of CVE-2019-1913 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Cisco Small Business 220 Series Smart Plus Switches
Sources
Also known as GHSA-f4rj-gx93-q8jm.