PT-2024-6633 · Cisco · Cisco Small Business Rv345+3

H4Lo · Published 2024-10-02 · Updated 2024-10-08 · CVE-2024-20393

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers (affected versions not specified)

Description: The issue is related to the web-based management interface of the affected devices, which discloses sensitive information due to inadequate authorization procedures. This could allow a remote attacker to elevate privileges from a guest to an admin level by sending crafted HTTP input to the affected device.

Recommendations: As a temporary workaround, consider restricting access to the web-based management interface until a patch is available. Avoid using the web-based management interface for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BDU:2024-07793

CVE-2024-20393

Affected Products

Cisco Small Business Rv340

Cisco Small Business Rv340W

Cisco Small Business Rv345

Cisco Small Business Rv345P

References · 16

• https://osv.dev/vulnerability/CVE-2024-20393 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv34x-privesc-rce-qE33TCm · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv34x-privesc-rce-qE33TCms · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-20393 · Security Note
• https://bdu.fstec.ru/vul/2024-07793 · Security Note
• https://t.me/cvenotify/97431 · Telegram Post
• https://twitter.com/CveFindCom/status/1841524101141131509 · Twitter Post
• https://twitter.com/vuldb/status/1841547837584314411 · Twitter Post
• https://twitter.com/ohhara_shiojiri/status/1843146689970102431 · Twitter Post
• https://twitter.com/pravin_karthik/status/1843334045100581161 · Twitter Post
• https://twitter.com/cracbot/status/1843169448938852695 · Twitter Post
• https://twitter.com/3cSoc/status/1843295164657504722 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1843119683177992513 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1841558858201702778 · Twitter Post
• https://twitter.com/socradar/status/1843238638366171243 · Twitter Post