Multiple vulnerabilities in Cisco Small Business RV Series Routers



Published: 2021-04-08
Risk Medium
Patch available YES
Number of vulnerabilities 3
CVE ID CVE-2021-1251
CVE-2021-1308
CVE-2021-1309
CWE ID CWE-401
CWE-400
CWE-119
Exploitation vector Local network
Public exploit N/A
Vulnerable software
Subscribe
RV132W ADSL2+ Wireless-N VPN Router
Hardware solutions / Routers & switches, VoIP, GSM, etc

RV134W VDSL2 Wireless-AC VPN Router
Hardware solutions / Routers & switches, VoIP, GSM, etc

Cisco Small Business RV160 Series VPN Router
Hardware solutions / Routers & switches, VoIP, GSM, etc

Cisco Small Business RV160W Wireless-AC VPN Router
Hardware solutions / Routers & switches, VoIP, GSM, etc

Cisco Small Business RV260 VPN Router
Hardware solutions / Routers & switches, VoIP, GSM, etc

Cisco Small Business RV260P VPN Router with POE
Hardware solutions / Routers & switches, VoIP, GSM, etc

Cisco Small Business RV260W Wireless-AC VPN Router
Hardware solutions / Routers & switches, VoIP, GSM, etc

Cisco RV340 Dual WAN Gigabit VPN Router
Hardware solutions / Routers & switches, VoIP, GSM, etc

Cisco RV340W Dual WAN Gigabit Wireless-AC VPN Router
Hardware solutions / Routers & switches, VoIP, GSM, etc

Cisco RV345 Dual WAN Gigabit VPN Router
Hardware solutions / Routers & switches, VoIP, GSM, etc

Cisco RV345P Dual WAN Gigabit POE VPN Router
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor Cisco Systems, Inc

Security Advisory

1) Memory leak

Risk: Low

CVSSv3.1: 6.4 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-1251

CWE-ID: CWE-401 - Improper Release of Memory Before Removing Last Reference ('Memory Leak')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due to missing length validation of certain LLDP packet header fields. A remote attacker on the local network can send a specially crafted LLDP packet and perform denial of service attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

RV132W ADSL2+ Wireless-N VPN Router: 1.0.1.14

RV134W VDSL2 Wireless-AC VPN Router: before 1.0.1.21

Cisco Small Business RV160 Series VPN Router: before 1.0.01.03

Cisco Small Business RV160W Wireless-AC VPN Router: before 1.0.01.03

Cisco Small Business RV260 VPN Router: before 1.0.01.03

Cisco Small Business RV260P VPN Router with POE: before 1.0.01.03

Cisco Small Business RV260W Wireless-AC VPN Router: before 1.0.01.03

Cisco RV340 Dual WAN Gigabit VPN Router: before 1.0.03.21

Cisco RV340W Dual WAN Gigabit Wireless-AC VPN Router: before 1.0.03.21

Cisco RV345 Dual WAN Gigabit VPN Router: before 1.0.03.21

Cisco RV345P Dual WAN Gigabit POE VPN Router: before 1.0.03.21

CPE External links

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-multi-lldp-u7e4chCe

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Resource exhaustion

Risk: Low

CVSSv3.1: 6.4 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-1308

CWE-ID: CWE-400 - Uncontrolled Resource Consumption ('Resource Exhaustion')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to missing length validation of certain LLDP packet header fields. A remote attacker on the local network can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

RV132W ADSL2+ Wireless-N VPN Router: 1.0.1.14

RV134W VDSL2 Wireless-AC VPN Router: before 1.0.1.21

Cisco Small Business RV160 Series VPN Router: before 1.0.01.03

Cisco Small Business RV160W Wireless-AC VPN Router: before 1.0.01.03

Cisco Small Business RV260 VPN Router: before 1.0.01.03

Cisco Small Business RV260P VPN Router with POE: before 1.0.01.03

Cisco Small Business RV260W Wireless-AC VPN Router: before 1.0.01.03

Cisco RV340 Dual WAN Gigabit VPN Router: before 1.0.03.21

Cisco RV340W Dual WAN Gigabit Wireless-AC VPN Router: before 1.0.03.21

Cisco RV345 Dual WAN Gigabit VPN Router: before 1.0.03.21

Cisco RV345P Dual WAN Gigabit POE VPN Router: before 1.0.03.21

CPE External links

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-multi-lldp-u7e4chCe

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Buffer overflow

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-1309

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the LLDP implementation. A remote attacker on the local network can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

RV132W ADSL2+ Wireless-N VPN Router: 1.0.1.14

RV134W VDSL2 Wireless-AC VPN Router: before 1.0.1.21

Cisco Small Business RV160 Series VPN Router: before 1.0.01.03

Cisco Small Business RV160W Wireless-AC VPN Router: before 1.0.01.03

Cisco Small Business RV260 VPN Router: before 1.0.01.03

Cisco Small Business RV260P VPN Router with POE: before 1.0.01.03

Cisco Small Business RV260W Wireless-AC VPN Router: before 1.0.01.03

Cisco RV340 Dual WAN Gigabit VPN Router: before 1.0.03.21

Cisco RV340W Dual WAN Gigabit Wireless-AC VPN Router: before 1.0.03.21

Cisco RV345 Dual WAN Gigabit VPN Router: before 1.0.03.21

Cisco RV345P Dual WAN Gigabit POE VPN Router: before 1.0.03.21

CPE External links

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-multi-lldp-u7e4chCe

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###