PT-2020-2957 · Cisco · Cisco Small Business Rv042+4
Published
2020-06-17
·
Updated
2020-06-23
·
CVE-2020-3278
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Cisco Small Business RV320 and RV325 Series Routers versions (affected versions not specified)
Cisco Small Business RV016, RV042, and RV082 Routers versions (affected versions not specified)
Description
The issue is related to multiple vulnerabilities in the web-based management interface of the affected routers. These vulnerabilities exist due to the interface's failure to properly validate user-supplied input to scripts. An authenticated, remote attacker with administrative privileges could exploit these vulnerabilities by sending malicious requests to an affected device, potentially allowing the execution of arbitrary commands with root privileges on the underlying operating system.
Recommendations
For Cisco Small Business RV320 and RV325 Series Routers, update to a version that includes the fix for the vulnerability.
For Cisco Small Business RV016, RV042, and RV082 Routers, update to a version that includes the fix for the vulnerability.
As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation.
Avoid using the web-based management interface for administrative tasks until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Command Injection
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Cisco Small Business Rv016
Cisco Small Business Rv042
Cisco Small Business Rv082
Cisco Small Business Rv320
Cisco Small Business Rv325