PT-2020-2956 · Cisco · Cisco Small Business Rv042+4

Published 2020-06-17 · Updated 2020-06-23 · CVE-2020-3277

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Small Business RV320 and RV325 Series Routers versions (affected versions not specified) Cisco Small Business RV016, RV042, and RV082 Routers versions (affected versions not specified)

Description The issue is related to multiple vulnerabilities in the web-based management interface of the affected routers. These vulnerabilities exist because the interface does not properly validate user-supplied input to scripts. An authenticated, remote attacker with administrative privileges could exploit these vulnerabilities by sending malicious requests to an affected device, potentially allowing the execution of arbitrary commands with root privileges on the underlying operating system.

Recommendations For Cisco Small Business RV320 and RV325 Series Routers, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Cisco Small Business RV016, RV042, and RV082 Routers, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

BDU:2020-03113

CVE-2020-3277

Affected Products

Cisco Small Business Rv016

Cisco Small Business Rv042

Cisco Small Business Rv082

Cisco Small Business Rv320

Cisco Small Business Rv325

References · 5

• https://osv.dev/vulnerability/CVE-2020-3277 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-routers-Rj5JRfF8 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03113 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-3277 · Security Note
• https://t.me/cvenotify/4444 · Telegram Post