PT-2023-1276 · Cisco · Cisco Small Business Rv345+3

Bing Liu + 1 · Publicado 2023-01-11 · Atualizado 2024-01-25 · CVE-2023-20007

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers (affected versions not specified)

Description A vulnerability in the web-based management interface could allow an authenticated, remote attacker to execute arbitrary code or cause the web-based management process on the device to restart unexpectedly, resulting in a denial of service (DoS) condition. The attacker must have valid administrator credentials. This issue is due to insufficient validation of user-supplied input to the web-based management interface. An attacker could exploit this by sending crafted HTTP input to an affected device, potentially allowing the execution of arbitrary code as the root user on the underlying operating system or causing the web-based management process to restart.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Buffer Overflow

Improper Resource Release

Enumeração de Fraquezas

CWE-78

CWE-120

CWE-404

Identificadores relacionados

BDU:2023-00544

CVE-2023-20007

Produtos afetados

Cisco Small Business Rv340

Cisco Small Business Rv340W

Cisco Small Business Rv345

Cisco Small Business Rv345P

Referências · 6

• https://t.me/cvenotify/43081 · Publicação no Telegram
• https://vuldb.com/ru/?id.218026 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-20007 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-00544 · Nota de Segurança
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv-rcedos-7HjP74jD · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-20007 · Aviso do Fabricante