PT-2021-1967 · Cisco · Cisco Small Business Rv042G+5
Published
2021-02-03
·
Updated
2021-02-05
·
CVE-2021-1327
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 (affected versions not specified)
Description:
The issue is related to insufficient validation of user-supplied input in the web-based management interface, which could allow a remote attacker to execute arbitrary code or cause the device to restart unexpectedly. The attacker would need to have valid administrator credentials on the affected device to exploit this issue. The exploitation could be done by sending crafted HTTP requests to the affected device, potentially leading to the execution of arbitrary code as the root user on the underlying operating system or causing the device to reload, resulting in a denial of service condition.
Recommendations:
For Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325, consider restricting access to the web-based management interface until a fix is available.
As a temporary workaround, limit the use of the web-based management interface to only necessary administrative tasks.
Avoid using the web-based management interface from untrusted networks or devices until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Stack Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cisco Small Business Rv016
Cisco Small Business Rv042
Cisco Small Business Rv042G
Cisco Small Business Rv082
Cisco Small Business Rv320
Cisco Small Business Rv325