Multiple Cisco embedded devices use hardcoded X.509 certificates and SSH host keys embedded in the firmware, which allows remote attackers t

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• cisco pvc2300 firmwareup to 1.1.2.6 inclusive
• cisco rtp300 firmwareup to 3.1.24 inclusive
• cisco rv120w firmwareup to 1.0.5.9 inclusive
• cisco rv180 firmwareup to 1.0.5.4 inclusive
• cisco rv180w firmwareup to 1.0.5.4 inclusive
• cisco rv220w firmwareup to 1.0.4.17 inclusive
• cisco rv315w firmwareup to 1.01.03 inclusive
• cisco rv320 firmwareup to 1.3.1.10 inclusive
• cisco rv325 firmwareup to 1.3.1.10 inclusive
• cisco rvs4000 firmwareup to 2.0.3.4 inclusive
• cisco spa400 firmwareup to 1.1.2.2 inclusive
• cisco srp520 firmwareup to 1.01.29 inclusive
• cisco srp520-u firmwareup to 1.2.6 inclusive
• cisco srw224p firmwareup to 2.0.2.4 inclusive
• cisco wap200 firmwareup to 2.0.6.0 inclusive
• cisco wap2000 firmwareup to 2.0.8.0 inclusive
• cisco wap4400n firmwareup to - inclusive
• cisco wap4410n firmwareup to 2.0.7.8 inclusive
• cisco wet200 firmwareup to 2.0.8.0 inclusive
• cisco wrp500 firmwareup to 1.0.1.002 inclusive

Other highest-scoring records for the same primary product.

• CVE-2019-1653Cisco Small Business RV320 and RV325 Routers Information Disclosure VulnerabilityKEV
  90Now
• CVE-2019-1652Cisco Small Business RV320 and RV325 Routers Command Injection VulnerabilityKEV
  87Now
• CVE-2023-20117Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection Vulnerabilities
  37Monitor
• CVE-2023-20128Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection Vulnerabilities
  37Monitor
• CVE-2019-1828Cisco Small Business RV320 and RV325 Routers Weak Credential Encryption Vulnerability
  32Monitor
• CVE-2019-1827Cisco Small Business RV320 and RV325 Routers Online Help Reflected Cross-Site Scripting Vulnerability
  24Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A certificate validation error is silently swallowed instead of terminating the connection. Often, code added for a test environment makes its way into production.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1override fun checkServerTrusted(chain: Array<X509Certificate>, type: String) {2  // Left empty for the test environment3}

1val client = OkHttpClient.Builder()2  .certificatePinner(3    CertificatePinner.Builder()4      .add("api.sirius.example", "sha256/…")5      .build()6  ).build()

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.