Hidden functionality in Cisco Systems, Inc products - #VU20874
Published: September 5, 2019
Vulnerability identifier: #VU20874
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-912
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise vulnerable system
The vulnerability exists due to hidden functionality (backdoor) is present in software. A remote authenticated attacker with access to the base operating system can use this functionality to view undocumented user accounts on an affected device. These accounts include debug-admin and root accounts.
Affected software
Cisco Small Business RV 260 Series VPN Router
Cisco Small Business RV160 Series VPN Router
Cisco RV340 Dual WAN Gigabit VPN Router
Cisco Small Business RV160 Series VPN Router
Cisco RV340 Dual WAN Gigabit VPN Router
Remediation
Install updates from vendor's website.
Cisco Small Business RV 260 Series VPN Router - update to 1.0.00.16
Cisco Small Business RV160 Series VPN Router - update to 1.0.00.16
Cisco RV340 Dual WAN Gigabit VPN Router - update to 1.0.03.16
Cisco Small Business RV160 Series VPN Router - update to 1.0.00.16
Cisco RV340 Dual WAN Gigabit VPN Router - update to 1.0.03.16