PT-2020-2887 · Cisco · Rv016+4

Published 2020-06-17 · Updated 2021-08-06 · CVE-2020-3294

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Small Business RV320 versions not specified Cisco Small Business RV325 versions not specified Cisco Small Business RV016 versions not specified Cisco Small Business RV042 versions not specified Cisco Small Business RV082 versions not specified

Description The issue is caused by insufficient boundary restrictions on user-supplied input to scripts in the web-based management interface, leading to a stack overflow. An attacker with administrative privileges could exploit this by sending crafted requests with overly large values to an affected device, potentially causing the device to crash or allowing the execution of arbitrary code with root privileges on the underlying operating system.

Recommendations For Cisco Small Business RV320, update to a version that fixes the issue. For Cisco Small Business RV325, update to a version that fixes the issue. For Cisco Small Business RV016, update to a version that fixes the issue. For Cisco Small Business RV042, update to a version that fixes the issue. For Cisco Small Business RV082, update to a version that fixes the issue. As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation.

Fix

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

BDU:2020-03044

CVE-2020-3294

Affected Products

Rv016

Rv042

Rv082

Rv320

Rv325

References · 5

• https://osv.dev/vulnerability/CVE-2020-3294 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-routers-stack-vUxHmnNz · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03044 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-3294 · Security Note
• https://t.me/cvenotify/4455 · Telegram Post