Cisco Small Business Series Switches Open Redirect Vulnerability
Cisco · Cisco Small Business 300 Series Managed Switches
A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Switches software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page via an open redirect attack. Cisco Small Business 200, 300, and 500 Series Switches are affected.
A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Switches software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attacker could exploit this vulnerability by intercepting a user's HTTP request and modifying it into a request that causes the web interface to redirect the user to a specific malicious URL. This type of vulnerability is known as an open redirect attack and is used in phishing attacks that get users to unknowingly visit malicious sites.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 4/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Public exploit code (Exploit-DB) was available 2 days before disclosure.
- Public exploit codeExploit-DB2 days before
- Disclosedday 0
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
3 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 3Initial AccessTA0001
Credential AccessTA0006
ImpactTA0040
Detection
0 rules for this CVE · 15 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2019-1943 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Adversary-in-the-MiddleT155710 general rules
- Suspicious Child Process of Notepad++ Updater - GUP.Exehighexperimental
- Uncommon File Created by Notepad++ Updater Gup.EXEhighexperimental
- Potential Suspicious Activity Using SeCEditmediumtest
- ISATAP Router Address Was Setmediumexperimental
- Notepad++ Updater DNS Query to Uncommon Domainsmediumexperimental
- Cisco BGP Authentication Failureslowtest
- Cisco LDP Authentication Failureslowtest
- Huawei BGP Authentication Failureslowtest
Transmitted Data ManipulationT1565.0022 general rules
- Cisco Modify Configurationmediumtest
- ISATAP Router Address Was Setmediumexperimental
Drive-by CompromiseT11893 general rules
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.