Cisco RVS4000/WRVS4400N Web Management Interface Information Disclosure Vulnerability

Bugtraq ID:	47988
Class:	Design Error
CVE:	CVE-2011-1645
Remote:	Yes
Local:	No
Published:	May 25 2011 12:00AM
Updated:	Jun 17 2011 05:50PM
Credit:	Michal Sajdak of Securitum
Vulnerable:	Cisco WRVS4400N Wireless-N Gigabit Security Router 2 Cisco WRVS4400N Wireless-N Gigabit Security Router 1.1 Cisco WRVS4400N Wireless-N Gigabit Security Router 1.0 Cisco RVS4000 4-port Gigabit Security Router 1.3.2 .0 Cisco RVS4000 4-port Gigabit Security Router 2 Cisco RVS4000 4-port Gigabit Security Router 1.3.0.3 Cisco RVS4000 4-port Gigabit Security Router 0
Not Vulnerable:	Cisco WRVS4400N Wireless-N Gigabit Security Router 2.0.2.1 Cisco RVS4000 4-port Gigabit Security Router 2.0.2.7 Cisco RVS4000 4-port Gigabit Security Router 1.3.3.5

Cisco RVS4000/WRVS4400N Web Management Interface Information Disclosure Vulnerability

Cisco RVS4000 and WRVS4400N routers are prone to an information-disclosure vulnerability.

An attacker can exploit this issue to obtain potentially sensitive information. This may aid in further attacks.

This issue is being tracked by Cisco bug ID CSCtn23871.

Cisco RVS4000/WRVS4400N Web Management Interface Information Disclosure Vulnerability

An attacker may exploit this issue using readily available tools.

Cisco RVS4000/WRVS4400N Web Management Interface Information Disclosure Vulnerability

Solution:
Updates are available; please see the references for details.

Cisco RVS4000/WRVS4400N Web Management Interface Information Disclosure Vulnerability

References:

• Cisco Homepage (Cisco)
  
• Cisco Security Advisory: Cisco RVS4000 and WRVS4400N Web Management Interface Vu (Cisco Systems Product Security Incident Response Team )
  
• cisco-sa-20110525-rvs4000 Cisco Security Advisory: Cisco RVS4000 and WRVS4400N W (Cisco)