Quantum Secular Labs / Blog / Advisories

CVE-2017-3882: Cisco Small Business Rv Router Firmware: Authentication bypass

CVE-2017-3882 is rated critical with a CVSS v3.0 base score of 9.6 and NVD lists 2 affected products, including Cisco Small Business Rv Router Firmware. Per its scoring, it can be exploited without authentication, without any user interaction. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

A vulnerability in the Universal Plug-and-Play (UPnP) implementation in the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, Layer 2-adjacent attacker to execute arbitrary code or cause a denial of service (DoS) condition. The remote code execution could occur with root privileges. The vulnerability is due to incomplete range checks of the UPnP input data, which could result in a buffer overflow. An attacker could exploit this vulnerability by sending a malicious request to the UPnP listening port of the targeted device. An exploit could allow the attacker to cause the device to reload or potentially execute arbitrary code with root privileges. This vulnerability affects all firmware releases of the Cisco CVR100W Wireless-N VPN Router prior to Firmware Release 1.0.1.22. Cisco Bug IDs: CSCuz72642.

Severity breakdown

CVSS v3.0 9.6: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

  • Attack vector: Adjacent. The attacker must be on the same shared network segment.
  • Attack complexity: Low. No special conditions; the attack can be repeated reliably.
  • Privileges required: None. No account or prior access is needed.
  • User interaction: None. No action from any user is needed.
  • Scope: Changed. Impact reaches beyond the vulnerable component to other resources.
  • Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
  • Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
  • Availability impact: High. Total loss of availability; the component can be shut down.

Underlying weakness

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

Affected products

  • Cisco Small Business Rv Router Firmware: 1.0.0.30; 1.0.1.9; 1.0.1.19; 1.0.2.6; 1.0.3.10; 1.0.4.10; 1.0.4.14; 1.0.5.4; 1.0.5.4\(gd\); 1.0.5.5; 1.0.5.6; 1.0.5.8
  • Cisco Small Business Rv Router Firmware 1.0: 0.2

References