PT-2022-6235 · Cisco · Cisco Rv345P+3

Wangjincheng · Published 2022-10-27 · Updated 2023-08-20 · CVE-2023-20073

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers (affected versions not specified)

Description A vulnerability in the web-based management interface of the affected devices could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device. This is due to insufficient authorization enforcement mechanisms in the context of file uploads. An attacker could exploit this by sending a crafted HTTP request to an affected device, potentially allowing the upload of arbitrary files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2023-00618

CVE-2023-20073

Affected Products

Cisco Rv340

Cisco Rv340W

Cisco Rv345

Cisco Rv345P

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2023-20073 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv-afu-EXxwA65V · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-20073 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00618 · Security Note
• https://t.me/cibsecurity/61484 · Telegram Post
• https://twitter.com/fofabot/status/1692774271628738713 · Twitter Post
• https://t.me/cybersecuritytechnologies/8883 · Telegram Post
• https://t.me/proxy_bar/1687 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023020153 · Note
• https://vuldb.com/?id.219987 · Note
• https://t.me/cvenotify/47613 · Telegram Post
• https://t.me/cvenotify/48033 · Telegram Post