Security Intelligence Center

Informe de vulnerabilidades por Activo

Tipo de documento Informe de vulnerabilidades por Activo

Fecha 2020-07-10T10:35:43.346Z

Autor Security Intelligence Center

Clasi cación de Seguridad

Vulnerabilidades
Activo afectado: cpe:/o:cisco:sg250x-24_ rmware:2.5.0.90

Código CVE Criticidad Última Publicación

CVE-2020-3297 10 09/07/2020 21:13

CVE-2020-3121 4.3 31/01/2020 18:32

Detalle vulnerabilidades

CVE-2020-3297
Criticidad: 10

Fecha Publicación

02/07/2020 07:15

Fecha Última Modi cación

09/07/2020 21:13

Resumen

A vulnerability in session management for the web-based interface of Cisco Small Business Smart and Managed Switches could allow
an unauthenticated, remote attacker to defeat authentication protections and gain unauthorized access to the management interface.
The attacker could obtain the privileges of the highjacked session account, which could include administrator privileges on the device.
The vulnerability is due to the use of weak entropy generation for session identi er values. An attacker could exploit this vulnerability
to determine a current session identi er through brute force and reuse that session identi er to take over an ongoing session. In this
way, an attacker could take actions within the management interface with privileges up to the level of the administrative user.

Métricas

Version2.0 Base Score: 10

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C  Severity:
 Security Intelligence Center - CiberSOC
Informe de vulnerabilidades por Activo

Access VectorNETWORK Exploitability Score: 10

Access ComplexityLOW Impact Score: 10

AuthenticationNONE Obtain All Privilege: false

Con dentiality ImpactCOMPLETE ObtainUser Privilege: false

Integrity ImpactCOMPLETE ObtainOther Privilege: false

Availability ImpactCOMPLETE User Interaction Required: false