PT-2021-1932 · Cisco · Cisco Small Business Rv160+4

T. Shiomitsu · Published 2021-02-03 · Updated 2021-02-08 · CVE-2021-1291

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers (affected versions not specified)

Description The issue exists in the web-based management interface of the affected devices due to improper validation of HTTP requests. An unauthenticated, remote attacker could exploit this by sending a crafted HTTP request to the interface, potentially allowing the execution of arbitrary code as the root user on the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-472

Related Identifiers

BDU:2021-00736

CVE-2021-1291

ZDI-21-132

Affected Products

Cisco Small Business Rv160

Cisco Small Business Rv160W

Cisco Small Business Rv260

Cisco Small Business Rv260P

Cisco Small Business Rv260W

References · 7

• https://bdu.fstec.ru/vul/2021-00736 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv160-260-rce-XZeFkNHf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1291 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-21-132 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-1291 · Security Note
• https://t.me/cvenotify/9600 · Telegram Post
• https://t.me/cibsecurity/23094 · Telegram Post