« Volver al listado

CVE-2015-6418

Estado: ModificadaMedia (4.3)—

The random-number generator on Cisco Small Business RV routers 4.x and SA500 security appliances 2.2.07 does not have sufficient entropy, which makes it easier for remote attackers to determine a TLS key pair via unspecified computations upon handshake key-exchange data, aka Bug ID CSCus15224.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (7)

Cisco — Rv016 Multi-wan VPN FirmwareCisco — Rv042 Dual WAN VPN Router FirmwareCisco — Rv042g Dual Gigabit WAN VPN FirmwareCisco — Rv082 Dual WAN VPN Router FirmwareCisco — Sa520Cisco — Sa520wCisco — Sa540

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-6418",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-12-13T03:59:09.477",
  "references": [
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-dwvr",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/78876",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1034408",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1034409",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-dwvr",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/78876",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1034408",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1034409",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The random-number generator on Cisco Small Business RV routers 4.x and SA500 security appliances 2.2.07 does not have sufficient entropy, which makes it easier for remote attackers to determine a TLS key pair via unspecified computations upon handshake key-exchange data, aka Bug ID CSCus15224."
    },
    {
      "lang": "es",
      "value": "El generador de número aleatorio en routers Cisco Small Business RV 4.x y dispositivos de seguridad SA500 2.2.07 no tiene suficiente entropía, lo que hace que sea más fácil para atacantes remotos determinar un par de claves TLS a través de computaciones no especificadas sobre datos de intercambio de clave en el apretón de manos, también conocido como Bug ID CSCus15224."
    }
  ],
  "lastModified": "2026-06-17T00:30:51.690",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:sa520:2.2.07:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5242A08F-0736-4FAC-B015-46BBF1115B08"
            },
            {
              "criteria": "cpe:2.3:o:cisco:sa520w:2.2.07:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F6B17623-8183-4C2C-A1BD-1654200D6AC3"
            },
            {
              "criteria": "cpe:2.3:o:cisco:sa540:2.2.07:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C7D2641C-CCFF-411A-96B4-F8823F4B4BA5"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:rv016_multi-wan_vpn_firmware:4.0.0.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C8A650F-4509-4632-92D3-72C412A49012"
            },
            {
              "criteria": "cpe:2.3:a:cisco:rv016_multi-wan_vpn_firmware:4.0.2.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC822B95-469E-4DB8-A1C0-B4AAA3D3644F"
            },
            {
              "criteria": "cpe:2.3:a:cisco:rv016_multi-wan_vpn_firmware:4.0.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "487B2A80-30AD-45F8-A46D-21E04888F3EA"
            },
            {
              "criteria": "cpe:2.3:a:cisco:rv042_dual_wan_vpn_router_firmware:4.0.2.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "00D012E7-A12E-44ED-8173-C8B254902886"
            },
            {
              "criteria": "cpe:2.3:a:cisco:rv042g_dual_gigabit_wan_vpn_firmware:4.0.0.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "303C48D9-1069-486B-8933-F51DFC82EDAC"
            },
            {
              "criteria": "cpe:2.3:a:cisco:rv042g_dual_gigabit_wan_vpn_firmware:4.2.2.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5F4636E-25F8-40E3-909F-CB9B93E290E5"
            },
            {
              "criteria": "cpe:2.3:a:cisco:rv042g_dual_gigabit_wan_vpn_firmware:4.2.2.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FDB96FF7-13B9-482F-85E7-C1C68287CF41"
            },
            {
              "criteria": "cpe:2.3:a:cisco:rv082_dual_wan_vpn_router_firmware:4.0.0.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CF1CDD04-A345-4982-A055-BBC990873C4D"
            },
            {
              "criteria": "cpe:2.3:a:cisco:rv082_dual_wan_vpn_router_firmware:4.0.2.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C92A1CD-5AE8-421E-A813-A2738219B673"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}