PT-2022-2469 · Cisco · Cisco Small Business Rv345+3
B0Ldfrev
+1
·
Published
2022-05-04
·
Updated
2023-07-24
·
CVE-2022-20801
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Cisco Small Business RV340 and RV345 Routers (affected versions not specified)
Cisco Small Business RV340W, RV345, and R345P (affected versions not specified)
Description
The issue is related to insufficient validation of user-supplied input in the web-based management interface of the affected devices. This could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying Linux operating system of an affected device. To exploit this issue, an attacker would need to have valid Administrator credentials on the affected device. The attacker could exploit the issue by sending malicious input to an affected device, potentially allowing the execution of arbitrary commands.
Recommendations
For Cisco Small Business RV340 and RV345 Routers, update the device to a version that includes the fix for this issue.
For Cisco Small Business RV340W, RV345, and R345P, update the device to a version that includes the fix for this issue.
As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation.
Restrict access to the
set-snmp command to minimize the risk of exploitation.Fix
OS Command Injection
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Cisco Small Business R345P
Cisco Small Business Rv340
Cisco Small Business Rv340W
Cisco Small Business Rv345