Medium severity · published Sep 23, 2020
CVE-2019-15993
A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information
5.3
CVSS
10.3%
EPSS
No
On KEV
Description
A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information. The vulnerability exists because the software lacks proper authentication controls to information accessible from the web UI. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web UI of an affected device. A successful exploit could allow the attacker to access sensitive device information, which includes configuration files.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)10.3% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
Sf250-24 Firmware · Cisco
before 2.5.0.92 · source: NVD
SF
Sf250-24p Firmware · Cisco
before 2.5.0.92 · source: NVD
SF
Sf250-48 Firmware · Cisco
before 2.5.0.92 · source: NVD
SF
Sf250-48hp Firmware · Cisco
before 2.5.0.92 · source: NVD
SF
Sf350-48 Firmware · Cisco
before 2.5.0.92 · source: NVD
SF
Sf350-48mp Firmware · Cisco
before 2.5.0.92 · source: NVD
SF
Sf350-48p Firmware · Cisco
before 2.5.0.92 · source: NVD
SF
Sf550x-24 Firmware · Cisco
before 2.5.0.92 · source: NVD
SF
Sf550x-24mp Firmware · Cisco
before 2.5.0.92 · source: NVD
SF
Sf550x-24p Firmware · Cisco
before 2.5.0.92 · source: NVD
SF
Sf550x-48 Firmware · Cisco
before 2.5.0.92 · source: NVD
SF
Sf550x-48mp Firmware · Cisco
before 2.5.0.92 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-15993
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-15993
packetstormsecurity.com
http://packetstormsecurity.com/files/171723/Cisco-Dell-Netgear-Information-Disclosure-Hash-Decrypter.html
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200129-smlbus-switch-disclos
More from Sf250-24 Firmware
9.8
CVE-2020-3297
A vulnerability in session management for the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to defeat…
8.8
CVE-2019-12636
A vulnerability in the web-based management interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site…
8.6
CVE-2020-3363
A vulnerability in the IPv6 packet processing engine of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to cause a denial of…
8.1
CVE-2021-34739
Cisco Small Business Series Switches Session Credentials Replay Vulnerability
6.1
CVE-2019-12718
A vulnerability in the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting…