Vulnerability Intelligence Report
CVE-2015-6319
SQL injection vulnerability in the web-based management interface on Cisco RV220W devices allows remote attackers to execute arbitrary SQL commands via a crafted header in an HTTP request, aka Bug ID CSCuv29574.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
EPSS Probability:2.69%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| cisco | rv016_multi-wan_vpn_router | all |
| cisco | rv042_dual_wan_vpn_router | all |
| cisco | rv042g_dual_gigabit_wan_vpn_router | all |
| cisco | rv082_dual_wan_vpn_router | all |
| cisco | rv110w_wireless-n_vpn_firewall | all |
| cisco | rv120w_wireless-n_vpn_firewall | all |
| cisco | rv130_vpn_router | all |
| cisco | rv130w_wireless-n_multifunction_vpn_router | all |
| cisco | rv180_vpn_router | all |
| cisco | rv180w_wireless-n_multifunction_vpn_router | all |
| cisco | rv215w_wireless-n_vpn_router | all |
| cisco | rv220w_wireless_network_security_firewall | all |
| cisco | rv320_dual_gigabit_wan_vpn_router | all |
| cisco | rv320_dual_gigabit_wan_wf_vpn_router | all |
| cisco | rv325_dual_gigabit_wan_wf_vpn_router | all |
| cisco | rv325_dual_wan_gigabit_vpn_router | all |
| cisco | rvl200_4-port_ssl_ipsec_vpn_router | all |
| cisco | rvs4000_4-port_gigabit_security_router_-_vpn | all |
| cisco | wrv200_wireless-g_vpn_router_-_rangebooster | all |
| cisco | wrv210_wireless-g_vpn_router_-_rangebooster | all |
| cisco | wrvs4400n_wireless-n_gigabit_security_router_-_vpn_v2.0 | all |
| cisco | rv_series_router_firmware | 1.0.0.2, 1.0.0.30, 1.0.1.9, 1.0.2.6, 1.0.3.10, 1.0.4.10, 1.0.4.14, 1.0.5.6, 1.0.5.8, 1.0.6.6, 1.1.0.9, 1.2.0.2 |
| sun | opensolaris | snv_124 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
2.689%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Cisco Systems, Inc. · Hosted Service · USA |
| Reserved | 2015-08-17T00:00:00 |
| Published | 2016-01-27T22:00:00 |
| Patch Date | 2016-01-27 |
| Last Updated | 2024-08-06T07:15:13 |
Community Chatter & Buzz