PT-2023-1334 · Cisco · Cisco Small Business Routers Rv042 Series+6
Hou Liuyang
+1
·
Published
2023-01-11
·
Updated
2025-03-12
·
CVE-2023-20026
CVSS v2.0
8.5
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Cisco Small Business Routers RV042 Series (affected versions not specified)
Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 (affected versions not specified)
Description
A vulnerability in the web-based management interface of Cisco Small Business Routers could allow an authenticated, remote attacker to inject arbitrary commands on an affected device. This issue is due to improper validation of user input fields within incoming HTTP packets. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface, potentially allowing the execution of arbitrary commands on an affected device with root-level privileges. To exploit this issue, an attacker would need to have valid Administrator credentials on the affected device.
Recommendations
For Cisco Small Business Routers RV042 Series: At the moment, there is no information about a newer version that contains a fix for this vulnerability.
For Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325: At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Command Injection
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Cisco Small Business Routers Rv016
Cisco Small Business Routers Rv042
Cisco Small Business Routers Rv042 Series
Cisco Small Business Routers Rv042G
Cisco Small Business Routers Rv082
Cisco Small Business Routers Rv320
Cisco Small Business Routers Rv325