CVE-2019-15993: cisco cisco small business 250 series smart switches software Configuration

Vulnerability summary

CVE-2019-15993 is a high (CVSS 7.5) Configuration vulnerability in cisco cisco small business 250 series smart switches software. EPSS estimates a 10.27% chance of exploitation in the next 30 days, higher than 95.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 23-09-2020
   PublishedVulnerability first disclosed.
2. 13-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information. The vulnerability exists because the software lacks proper authentication controls to information accessible from the web UI. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web UI of an affected device. A successful exploit could allow the attacker to access sensitive device information, which includes configuration files.

• CWE-16ConfigurationWeaknesses in this category are typically introduced during the configuration of the software.
• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.