Cisco fails to fix two high-risk flaws in small business routers

The remote-code execution and information disclosure bugs have been unpatched since January

Two critical vulnerabilities in small business routers first flagged months ago have yet to receive adequate fixes despite regular rounds of patching.

A pair of critical bugs in Cisco's RV320 and RV325 Dual Gigabit WAN VPN Routers were issued with initial fixes that were found to be incomplete, the company has admitted.

Advertisement - Article continues below

These failed patches were attempted as part of a wave of fixes issued yesterday, largely to plug gaps in the firm's IOS and IOS XE software.

There were 25 issues fixed in total, six of which were rated 'medium' while 19 were considered high-risk. Among this round of patches were patches for several command injection vulnerabilities and privilege escalation flaws.

"The initial fix for this vulnerability was found to be incomplete," the networking giant said of both bugs. "Cisco is currently working on a complete fix."

Both flaws were first flagged on 23 January this year, but there have been no successful fixes or workarounds identified to date. The company then elaborated on the nature of the bugs two days later.

The first, dubbed CVE-2019-1652, concerns a remote-code execution hole that, if exploited, could allow a remote attacker with admin privileges to execute arbitrary commands on one of the affected routers. The second, CVE-2019-1653, could allow an attacker to retrieve sensitive information such as router configuration or detailed diagnostic information.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

The information disclosure flaw is due to improper access controls for URLs, whereby an attacker can connect to an affected device through HTTP or HTTPS and request specific URLs. The remote-code execution vulnerability, meanwhile, can be exploited by sending malicious HTTP POST requests to a router's web-based management interface.

Cyber security expert Graham Cluley told IT Pro the fact both vulnerabilities remain unpatched was troubling news for small business.

"In both of these cases, Cisco thought it had previously fixed the vulnerability in January - but has now found that it had failed to do so properly.

"The bad news for small businesses who might be using these devices is that Cisco doesn't currently have a working patch, and is unable to even suggest a workaround. The potential is therefore there for online criminals to try to exploit the flaws which Cisco itself has rated as high severity.

"Let's hope that Cisco is able to roll out a working firmware update sooner rather than later."

Cisco says it aims to fix the vulnerabilities, which are present in routers running Firmware Release 1.4.2.15 and later, with an updated Firmware version. This is expected to be released by the middle of April 2019.

Featured Resources

Preparing for long-term remote working after COVID-19

Learn how to safely and securely enable your remote workforce

Download now

Cloud vs on-premise storage: What’s right for you?

Key considerations driving document storage decisions for businesses

Download now

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Transforming productivity

Solutions that facilitate work at full speed

Download now
Advertisement

Recommended

Visit/security/ransomware/356292/university-of-california-gets-fleeced-by-hackers-for-114-million
ransomware

University of California gets fleeced by hackers for $1.14 million

30 Jun 2020
Visit/security/cyber-security/356289/australia-announces-135b-investment-in-cybersecurity
cyber security

Australia announces $1.35 billion investment in cyber security

30 Jun 2020
Visit/cloud/cloud-security/356288/csa-and-issa-form-cybersecurity-partnership
cloud security

CSA and ISSA form cyber security partnership

30 Jun 2020
Visit/security/ethical-hacking/356252/poorly-secured-banking-apps-lead-to-cyber-threats
ethical hacking

Mobile banking apps are exposing user data to attackers

26 Jun 2020

Most Popular

Visit/business/business-operations/356395/nvidia-overtakes-intel-as-most-valuable-us-chipmaker
Business operations

Nvidia overtakes Intel as most valuable US chipmaker

9 Jul 2020
Visit/laptops/29190/how-to-find-ram-speed-size-and-type
Laptops

How to find RAM speed, size and type

24 Jun 2020
Visit/server-storage/servers/356083/the-best-server-solution-for-your-smb
Sponsored

The best server solution for your SMB

26 Jun 2020