CVE-2019-1913 (CNNVD-201908-426)
中文标题:
Cisco Small Business 220 Series Smart Switches 缓冲区错误漏洞
英文标题:
Cisco Small Business 220 Series Smart Switches Remote Code Execution Vulnerabilities
漏洞描述
中文描述:
Cisco Small Business 220 Series Smart Switches是美国思科（Cisco）公司的一款小型智能交换机设备。 使用1.1.4.4之前版本固件的Cisco Small Business 220 Series Smart Switches中的Web管理界面存在缓冲区错误漏洞，该漏洞源于程序没有充分地验证用户提交的数据并且没有进行正确的边界检查。远程攻击者可通过发送恶意的请求利用该漏洞在底层操作系统上以root权限执行任意代码。
英文描述:
Multiple vulnerabilities in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote attacker to overflow a buffer, which then allows the execution of arbitrary code with root privileges on the underlying operating system. The vulnerabilities are due to insufficient validation of user-supplied input and improper boundary checks when reading data into an internal buffer. An attacker could exploit these vulnerabilities by sending malicious requests to the web management interface of an affected device. Depending on the configuration of the affected switch, the malicious requests must be sent via HTTP or HTTPS.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Cisco | Cisco Small Business 220 Series Smart Plus Switches | - | < 1.1.4.4 | - |
cpe:2.3:a:cisco:cisco_small_business_220_series_smart_plus_switches:*:*:*:*:*:*:*:*
|
| cisco | sf-220-24_firmware | * | - | - |
cpe:2.3:o:cisco:sf-220-24_firmware:*:*:*:*:*:*:*:*
|
| cisco | sf220-24p_firmware | * | - | - |
cpe:2.3:o:cisco:sf220-24p_firmware:*:*:*:*:*:*:*:*
|
| cisco | sf220-48_firmware | * | - | - |
cpe:2.3:o:cisco:sf220-48_firmware:*:*:*:*:*:*:*:*
|
| cisco | sf220-48p_firmware | * | - | - |
cpe:2.3:o:cisco:sf220-48p_firmware:*:*:*:*:*:*:*:*
|
| cisco | sg220-26_firmware | * | - | - |
cpe:2.3:o:cisco:sg220-26_firmware:*:*:*:*:*:*:*:*
|
| cisco | sg220-26p_firmware | * | - | - |
cpe:2.3:o:cisco:sg220-26p_firmware:*:*:*:*:*:*:*:*
|
| cisco | sg220-28_firmware | * | - | - |
cpe:2.3:o:cisco:sg220-28_firmware:*:*:*:*:*:*:*:*
|
| cisco | sg220-28mp_firmware | * | - | - |
cpe:2.3:o:cisco:sg220-28mp_firmware:*:*:*:*:*:*:*:*
|
| cisco | sg220-50_firmware | * | - | - |
cpe:2.3:o:cisco:sg220-50_firmware:*:*:*:*:*:*:*:*
|
| cisco | sg220-50p_firmware | * | - | - |
cpe:2.3:o:cisco:sg220-50p_firmware:*:*:*:*:*:*:*:*
|
| cisco | sg220-52_firmware | * | - | - |
cpe:2.3:o:cisco:sg220-52_firmware:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
cve.org
exploitdb
exploitdb
cve.org
cve.org
cve.org
CVSS评分详情
3.0 (cna)
CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2019-1913 |
2025-11-11 15:20:09 | 2025-11-11 07:35:41 |
| NVD | nvd_CVE-2019-1913 |
2025-11-11 14:56:25 | 2025-11-11 07:44:11 |
| CNNVD | cnnvd_CNNVD-201908-426 |
2025-11-11 15:10:15 | 2025-11-11 07:54:51 |
| EXPLOITDB | exploitdb_EDB-47442 |
2025-11-11 15:05:22 | 2025-11-11 08:52:16 |
版本与语言
安全公告
变更历史
查看详细变更
- references_count: 2 -> 7
- tags_count: 0 -> 3
- data_sources: ['cnnvd', 'cve', 'nvd'] -> ['cnnvd', 'cve', 'exploitdb', 'nvd']
查看详细变更
- vulnerability_type: 未提取 -> 缓冲区错误
- cnnvd_id: 未提取 -> CNNVD-201908-426
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 12
- data_sources: ['cve'] -> ['cve', 'nvd']