description: A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.
This vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by persuading a user to visit specific web pages that include malicious payloads. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
problem types: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
affected:
{
vendor: Cisco
product: Cisco Small Business RV Series Router Firmware
versions:
version: 1.1.0.09, status: affected
version: 1.1.1.19, status: affected
version: 1.1.1.06, status: affected
version: 1.2.1.14, status: affected
version: 2.0.0.19-tm, status: affected
version: 1.3.1.12, status: affected
version: 1.3.1.10, status: affected
version: 1.3.12.6-tm, status: affected
version: 1.3.13.02-tm, status: affected
version: 4.0.0.7, status: affected
version: 4.0.2.08-tm, status: affected
version: 4.0.3.03-tm, status: affected
version: 4.0.4.02-tm, status: affected
version: 4.2.2.08, status: affected
version: 4.2.3.03, status: affected
version: 4.2.3.06, status: affected
version: 4.2.3.07, status: affected
version: 4.2.3.09, status: affected
version: 4.2.3.10, status: affected
version: 4.2.3.14, status: affected
version: 1.4.2.15, status: affected
version: 1.4.2.17, status: affected
version: 1.4.2.19, status: affected
version: 1.4.2.22, status: affected
version: 3.0.0.1-tm, status: affected
version: 4.1.1.01, status: affected
version: 1.5.1.05, status: affected
}
metrics:
format: cvssV3_1
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
baseScore: 6.1
baseSeverity: MEDIUM
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
]
exploits: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.