| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE ID | CVE-2021-1472 CVE-2021-1473 |
| CWE ID | CWE-284 CWE-77 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Cisco RV340 Dual WAN Gigabit VPN Router Hardware solutions / Routers & switches, VoIP, GSM, etc Cisco RV340W Dual WAN Gigabit Wireless-AC VPN Router Hardware solutions / Routers & switches, VoIP, GSM, etc Cisco RV345 Dual WAN Gigabit VPN Router Hardware solutions / Routers & switches, VoIP, GSM, etc Cisco RV345P Dual WAN Gigabit POE VPN Router Hardware solutions / Routers & switches, VoIP, GSM, etc Cisco Small Business RV160 Series VPN Router Hardware solutions / Routers & switches, VoIP, GSM, etc Cisco Small Business RV160W Wireless-AC VPN Router Hardware solutions / Routers & switches, VoIP, GSM, etc Cisco Small Business RV260 VPN Router Hardware solutions / Routers & switches, VoIP, GSM, etc Cisco Small Business RV260P VPN Router with POE Hardware solutions / Routers & switches, VoIP, GSM, etc Cisco Small Business RV260W Wireless-AC VPN Router Hardware solutions / Routers & switches, VoIP, GSM, etc |
| Vendor | Cisco Systems, Inc |
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C] [PCI]
CVE-ID: CVE-2021-1472
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote attacker can send a specially crafted HTTP request, upload files to directories that should have been restricted.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCisco RV340 Dual WAN Gigabit VPN Router: 1.0.03.20
Cisco RV340W Dual WAN Gigabit Wireless-AC VPN Router: 1.0.03.20
Cisco RV345 Dual WAN Gigabit VPN Router: 1.0.03.20
Cisco RV345P Dual WAN Gigabit POE VPN Router: 1.0.03.20
Cisco Small Business RV160 Series VPN Router: before 1.0.01.03
Cisco Small Business RV160W Wireless-AC VPN Router: before 1.0.01.03
Cisco Small Business RV260 VPN Router: before 1.0.01.03
Cisco Small Business RV260P VPN Router with POE: before 1.0.01.03
Cisco Small Business RV260W Wireless-AC VPN Router: before 1.0.01.03
CPECan this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
Risk: High
CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]
CVE-ID: CVE-2021-1473
CWE-ID:
CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary commands on the target system.
The vulnerability exists due to improper input validation in the web-based management interface. A remote attacker can pass specially crafted data to the application and execute arbitrary commands on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsCisco RV340 Dual WAN Gigabit VPN Router: 1.0.03.20
Cisco RV340W Dual WAN Gigabit Wireless-AC VPN Router: 1.0.03.20
Cisco RV345 Dual WAN Gigabit VPN Router: 1.0.03.20
Cisco RV345P Dual WAN Gigabit POE VPN Router: 1.0.03.20
CPECan this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.