CVE-2012-0365

Directory traversal vulnerability in the Local TFTP file-upload application on Cisco SRP 520 series devices with firmware before 1.1.26 and SRP 520W-U and 540 series devices with firmware before 1.2.4 allows remote authenticated users to upload software to arbitrary directories via unspecified vectors, aka Bug ID CSCtw56009.

Score

CVSS 2.0 9.0 Critical

Status

Modified - psirt@cisco.com

Published

2012-02-25

Last modified

2024-08-06

Weaknesses

CWE-22

Affected products

• Small Business Srp520-u Series Firmware (Cisco)
• Small Business Srp520 Series Firmware (Cisco)
• Small Business Srp521w (Cisco)
• Small Business Srp521w-u (Cisco)
• Small Business Srp526w (Cisco)
• Small Business Srp526w-u (Cisco)
• Small Business Srp527w (Cisco)
• Small Business Srp527w-u (Cisco)
• Small Business Srp540 Series Firmware (Cisco)
• Small Business Srp541w (Cisco)
• Small Business Srp546w (Cisco)
• Small Business Srp547w (Cisco)

References

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120223-srp500
• http://www.securitytracker.com/id?1026736