PT-2021-2540 · Cisco · Cisco Small Business Rv Series Routers

Qian Chen · Published 2021-04-07 · Updated 2022-08-05 · CVE-2021-1308

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Cisco Small Business RV Series Routers (affected versions not specified)

Description: The issue is related to the implementation of the Link Layer Discovery Protocol (LLDP) in the firmware of Cisco Small Business RV Series Routers, which is associated with an uncontrolled resource consumption. This could allow a remote attacker to cause the device to reload. An unauthenticated, adjacent attacker could execute arbitrary code or cause the affected router to leak system memory or reload, resulting in a denial of service (DoS) condition on the affected device. The attacker must be in the same broadcast domain as the affected device to exploit these vulnerabilities.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Resource Exhaustion

Memory Leak

Weakness Enumeration

CWE-119

CWE-400

CWE-401

Related Identifiers

BDU:2021-01946

CVE-2021-1308

Affected Products

Cisco Small Business Rv Series Routers

References · 8

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-multi-lldp-u7e4chCe · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1308 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01946 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-1308 · Security Note
• https://t.me/cvenotify/12919 · Telegram Post
• https://t.me/cvenotify/13265 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021040812 · Note
• https://t.me/cvenotify/12902 · Telegram Post