CVE-2015-6319 SQL injection vulnerability in the web-based management interface on Cisco RV220W devices allows remote attackers to execute arbitrary SQL commands via a crafted header in an HTTP request, aka Bug ID....
CriticalCVSS 9.8
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in the web-based management interface on Cisco RV220W devices allows remote attackers to execute arbitrary SQL commands via a crafted header in an HTTP request, aka Bug ID CSCuv29574.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco rv series router firmware | = 1.0.0.2 | No fix listed |
| cisco rv series router firmware | = 1.0.0.30 | No fix listed |
| cisco rv series router firmware | = 1.0.1.9 | No fix listed |
| cisco rv series router firmware | = 1.0.2.6 | No fix listed |
| cisco rv series router firmware | = 1.0.3.10 | No fix listed |
| cisco rv series router firmware | = 1.0.4.10 | No fix listed |
| cisco rv series router firmware | = 1.0.4.14 | No fix listed |
| cisco rv series router firmware | = 1.0.5.6 | No fix listed |
| cisco rv series router firmware | = 1.0.5.8 | No fix listed |
| cisco rv series router firmware | = 1.0.6.6 | No fix listed |
| cisco rv series router firmware | = 1.1.0.9 | No fix listed |
| cisco rv series router firmware | = 1.2.0.2 | No fix listed |
| sun opensolaris | = snv_124 | No fix listed |
References
- 20160127 Cisco RV220W Management Authentication Bypass Vulnerability vendor-advisory
- 1034830 vdb-entry