CVE-2015-6319

SQL injection vulnerability in the web-based management interface on Cisco RV220W devices allows remote attackers to execute arbitrary SQL commands via a crafted header in an HTTP request, aka Bug ID CSCuv29574.

Published: Jan 27, 2016
Updated: Apr 13, 2023
CVE: CVE-2015-6319
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: High
Score: 10
AV:N/AC:L/Au:N/C:C/I:C/A:C

CWEs:

CWE-89

OWASP TOP 10:

A1 - Injection

Affected Software
References

Software	From	Fixed in
cisco / rv_series_router_firmware	1.0.0.2	1.0.0.2.x
cisco / rv_series_router_firmware	1.0.0.30	1.0.0.30.x
cisco / rv_series_router_firmware	1.0.1.9	1.0.1.9.x
cisco / rv_series_router_firmware	1.0.2.6	1.0.2.6.x
cisco / rv_series_router_firmware	1.0.3.10	1.0.3.10.x
cisco / rv_series_router_firmware	1.0.4.10	1.0.4.10.x
cisco / rv_series_router_firmware	1.0.4.14	1.0.4.14.x
cisco / rv_series_router_firmware	1.0.5.6	1.0.5.6.x
cisco / rv_series_router_firmware	1.0.5.8	1.0.5.8.x
cisco / rv_series_router_firmware	1.0.6.6	1.0.6.6.x
cisco / rv_series_router_firmware	1.1.0.9	1.1.0.9.x
cisco / rv_series_router_firmware	1.2.0.2	1.2.0.2.x
sun / opensolaris	snv_124	snv_124.x

Vulnerability Database

CVE-2015-6319