CVE:CVE-2012-0365
CNNVD:CNNVD-201202-454
Cisco SRP 500系统设备是服务提供商给客户创建、配置和部署服务的设备。
Cisco SRP 500系统设备在本地TFTP文件上传应用的实现上存在目录遍历漏洞。攻击者可利用该漏洞通过特制链接或恶意文件，导致任意文件上传。
solution:Upgrade cisco small_business_srp520_series_firmware to a higher version than 1.01.24,1.01.01,1.01.09,1.01.11,1.01.19,1.01.23,and avoid the version (,1.01.24],1.01.01,1.01.09,1.01.11,1.01.19,1.01.23; Upgrade cisco small_business_srp521w to a higher version than *; Upgrade cisco small_business_srp526w to a higher version than *; Upgrade cisco small_business_srp527w to a higher version than *; Upgrade cisco small_business_srp520-u_series_firmware to a higher version than 1.1.0,and avoid the version 1.1.0; Upgrade cisco small_business_srp521w-u to a higher version than *; Upgrade cisco small_business_srp526w-u to a higher version than *; Upgrade cisco small_business_srp527w-u to a higher version than *; Upgrade cisco small_business_srp540_series_firmware to a higher version than 1.02.01,1.02.00.023,and avoid the version (,1.02.01],1.02.00.023; Upgrade cisco small_business_srp541w to a higher version than *; Upgrade cisco small_business_srp546w to a higher version than *; Upgrade cisco small_business_srp547w to a higher version than *