1. Home
  2. CVE Database
  3. CVE-2019-1912
CRITICAL · 9.1

CVE-2019-1912

A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote attacker to upload arbitrary files. The vulnerability is due to...

Vulnerability Description

A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote attacker to upload arbitrary files. The vulnerability is due to incomplete authorization checks in the web management interface. An attacker could exploit this vulnerability by sending a malicious request to certain parts of the web management interface. Depending on the configuration of the affected switch, the malicious request must be sent via HTTP or HTTPS. A successful exploit could allow the attacker to modify the configuration of an affected device or to inject a reverse shell. This vulnerability affects Cisco Small Business 220 Series Smart Switches running firmware versions prior to 1.1.4.4 with the web management interface enabled. The web management interface is enabled via both HTTP and HTTPS by default.

CVSS Score

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
CiscoSf-220-24 Firmware< 1.1.4.4
CiscoSf-220-24-
CiscoSf220-24P Firmware< 1.1.4.4
CiscoSf220-24P-
CiscoSf220-48 Firmware< 1.1.4.4
CiscoSf220-48-
CiscoSf220-48P Firmware< 1.1.4.4
CiscoSf220-48P-
CiscoSg220-26 Firmware< 1.1.4.4
CiscoSg220-26-
CiscoSg220-26P Firmware< 1.1.4.4
CiscoSg220-26P-
CiscoSg220-28 Firmware< 1.1.4.4
CiscoSg220-28-
CiscoSg220-28Mp Firmware< 1.1.4.4
CiscoSg220-28Mp-
CiscoSg220-50 Firmware< 1.1.4.4
CiscoSg220-50-
CiscoSg220-50P Firmware< 1.1.4.4
CiscoSg220-50P-

Related Weaknesses (CWE)

CWE-285CWE-863

References

FAQ

What is CVE-2019-1912?

CVE-2019-1912 is a vulnerability with a CVSS score of 9.1 (CRITICAL). A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote attacker to upload arbitrary files. The vulnerability is due to...

How severe is CVE-2019-1912?

CVE-2019-1912 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2019-1912?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Sf-220-24 Firmware, Cisco Sf-220-24, Cisco Sf220-24P Firmware, Cisco Sf220-24P, Cisco Sf220-48 Firmware.