CVE-2016-1470

EUVD-2016-2569
Cross-site request forgery (CSRF) vulnerability in the web-based management interface on Cisco Small Business 220 devices with firmware before 1.0.1.1 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuz76230.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 33%
Affected Products (NVD)
VendorProductVersion
ciscosmall_business_220_series_smart_plus_switches
1.0.0.17
ciscosmall_business_220_series_smart_plus_switches
1.0.0.18
ciscosmall_business_220_series_smart_plus_switches
1.0.0.19
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-sps
http://www.securityfocus.com/bid/92709
http://www.securitytracker.com/id/1036722
http://www.synacktiv.com/ressources/advisories_cisco_switch_sg220_csrf.pdf
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-sps
http://www.securityfocus.com/bid/92709
http://www.securitytracker.com/id/1036722
http://www.synacktiv.com/ressources/advisories_cisco_switch_sg220_csrf.pdf