What is the CVSS score of CVE-2012-0365?

CVE-2012-0365 has a CVSS 2.0 base score of 9.0 (Critical). CVSS vector: AV:N/AC:L/Au:S/C:C/I:C/A:C. EPSS exploitation probability: 0.4%.

Small Business Srp520 Series Firmware CVE-2012-0365

CRITICAL

Path Traversal (CWE-22)

2012-02-25 psirt@cisco.com

Path Traversal Cisco Small Business Srp520 Series Firmware Small Business Srp521W Small Business Srp526W Small Business Srp527W Small Business Srp520 U Series Firmware Small Business Srp521W U Small Business Srp526W U Small Business Srp527W U Small Business Srp540 Series Firmware Small Business Srp541W Small Business Srp546W Small Business Srp547W

9.0

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

9.0 CRITICAL

AV:N/AC:L/Au:S/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:S/C:C/I:C/A:C

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Feb 25, 2012 - 04:21 cve.org

CRITICAL 9.0

DescriptionCVE.org

Directory traversal vulnerability in the Local TFTP file-upload application on Cisco SRP 520 series devices with firmware before 1.1.26 and SRP 520W-U and 540 series devices with firmware before 1.2.4 allows remote authenticated users to upload software to arbitrary directories via unspecified vectors, aka Bug ID CSCtw56009.

AnalysisAI

Directory traversal vulnerability in the Local TFTP file-upload application on Cisco SRP 520 series devices with firmware before 1.1.26 and SRP 520W-U and 540 series devices with firmware before. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. Directory traversal vulnerability in the Local TFTP file-upload application on Cisco SRP 520 series devices with firmware before 1.1.26 and SRP 520W-U and 540 series devices with firmware before 1.2.4 allows remote authenticated users to upload software to arbitrary directories via unspecified vectors, aka Bug ID CSCtw56009. Affected products include: Cisco Small Business Srp520 Series Firmware, Cisco Small Business Srp521W, Cisco Small Business Srp526W, Cisco Small Business Srp527W, Cisco Small Business Srp520-U Series Firmware. Version information: before 1.1.26.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.