Cisco partially eliminated vulnerabilities in routers for small business. Update for Cisco RV220W Wireless Network Security Firewall will be available within a month.
As follows from the security notices published by Cisco developers on Wednesday, November 5, the company eliminated the dangerous vulnerabilities in four models of its routers series RV, intended for use by small businesses.
Problems addressed devices include: Cisco RV120W Wireless-N VPN Firewall with outdated firmware (version to 1.0.5.9), Cisco RV180 VPN Router – up to version 1.0.4.14, as well as Cisco RV180W Wireless-N Multifunction VPN Router – up to 1.0.4.14. In addition, a vulnerable is Cisco RV220W Wireless Network Security Firewall (all current versions of the firmware).
The most dangerous of vulnerability is the vulnerability which could allow a remote attacker to execute arbitrary code on the target system, after the passage of the one-factor authentication.
Interestingly, all three eliminated flaws (CVE-2014-2177, CVE-2014-2178 and CVE-2014-2179) have been discovered by researcher security Yorick Koster of the company Securify.
In Cisco emphasize that the security patch for Cisco RV220W Wireless Network Security Firewall is currently not available, but download and install it will be before the end of this month. At the same time, as a precaution, administrators can disable the functionality of the remote control device, or limit remote management access to trusted IP addresses.
CVE-2014-2177 – vulnerability: Cisco RV Series Routers Command Injection Vulnerability (a command injection flaw that can be exploited by a remote, authenticated attacker to execute arbitrary commands on vulnerable systems)
CVE-2014-2178 – vulnerability: Cisco RV Series Routers HTTP Referer Header Vulnerability (a HTTP referer header vulnerability that can be exploited by a remote, unauthenticated attacker for cross-site request forgery (CSRF) attacks)
CVE-2014-2179 – vulnerability: Cisco RV Series Routers Insecure File Upload Vulnerability (an insecure file upload vulnerability that can be leveraged by a remote, unauthenticated attacker to upload files to arbitrary locations on affected RV series routers)
References:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141105-rv
