PT-2023-9505 · Cisco · Cisco Small Business Rv042G+3

K0Mor3B1 · Published 2023-11-08 · Updated 2024-10-08 · CVE-2024-20524

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Small Business RV042, RV042G, RV320, and RV325 Routers (affected versions not specified)

Description The issue is related to improper validation of user input in incoming HTTP packets, which could allow a remote attacker to cause an unexpected reload of the device, resulting in a denial of service (DoS) condition. The attacker would need to have valid Administrator credentials on the affected device to exploit this vulnerability. This can be achieved by sending a crafted HTTP request to the web-based management interface of the affected device.

Recommendations To resolve the issue, update the firmware of the Cisco Small Business RV042, RV042G, RV320, and RV325 Routers to a version that includes the fix for this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

BDU:2024-07998

CVE-2024-20524

Affected Products

Cisco Small Business Rv042

Cisco Small Business Rv042G

Cisco Small Business Rv320

Cisco Small Business Rv325

References · 8

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv04x_rv32x_vulns-yJ2OSDhV · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-20524 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07998 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-20524 · Security Note
• https://vuldb.com/?id.279098 · Note
• https://t.me/cvedetector/6849 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1841570384073671030 · Twitter Post
• https://twitter.com/CVEnew/status/1841527229727310098 · Twitter Post