SB2022020301 - Multiple vulnerabilities in Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022020301

SB2022020301 - Multiple vulnerabilities in Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers

Published: February 3, 2022 Updated: February 15, 2023

Security Bulletin ID SB2022020301
Severity
Critical
Patch available
YES
Number of vulnerabilities 14
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Critical 21% High 29% Medium 36% Low 14%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 14 secuirty vulnerabilities.


1) Buffer overflow (CVE-ID: CVE-2022-20712)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTTP requests. A remote attacker can send a specially crafted HTTP request to the device, trigger memory corruption and execute arbitrary code on the target system with non-root privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


2) Input validation error (CVE-ID: CVE-2022-20711)

The vulnerability allows a remote attacker to overwrite arbitrary files on the system.

The vulnerability exists due to insufficient validation of user-supplied input for specific components of the web UI. A remote non-authenticated attacker can send specially crafted HTTP request to the affected device and overwrite certain files, served by the web UI process. Successful exploitation of the vulnerability may allow an attacker to exfiltrate information.

3) Improper Handling of Exceptional Conditions (CVE-ID: CVE-2022-20710)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to to erroneously handled exceptions during failed login attempts in the login functionality of the web-based management interface.. A remote non-authenticated attacker can send specially crafted HTTP requests to the affected device and prevent users from logging in.

4) Arbitrary file upload (CVE-ID: CVE-2022-20709)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack or compromise the affected system.

The vulnerability exists due to improper access restrictions in the web-based management interface. A remote non-authenticated attacker can upload arbitrary files to the device.

Successful exploitation of the vulnerability may allow an attacker to perform a DoS attack by filling up all available space on the device or use the uploaded files in further attacks.

5) OS Command Injection (CVE-ID: CVE-2022-20749)

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the web-based management interface. A remote non-authenticated attacker can send a specially crafted request to the affected device to inject and execute arbitrary commands on the underlying operating system.



6) OS Command Injection (CVE-ID: CVE-2022-20707)

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation within the handling of file-copy JSON RPC requests in the web-based management interface. A remote non-authenticated attacker can send a specially crafted request to the affected device to inject and execute arbitrary commands on the underlying operating system.



7) OS Command Injection (CVE-ID: CVE-2022-20708)

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation within the handling of the update-clients method in the web-based management interface. A remote non-authenticated attacker can send a specially crafted request to the affected device to inject and execute arbitrary commands on the underlying operating system.



8) OS Command Injection (CVE-ID: CVE-2022-20706)

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the Open Plug and Play (PnP) module of Cisco Small Business RV Series Routers. A remote unauthenticated attacker can execute arbitrary commands on the underlying Linux operating system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system but requires a man-in-the-middle position or having an established foothold on a specific network device that is connected to the vulnerable router.


9) Improper Authentication (CVE-ID: CVE-2022-20705)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in the session management of the web UI. A remote non-authenticated attacker can brute force to determine a current session identifier and then reuse it to take over an ongoing session or by crafting a new, valid session identifier and bypassing the whole authentication mechanism.

Successful exploitation of the vulnerability may allow an attacker to compromise the affected device.

10) Improper Certificate Validation (CVE-ID: CVE-2022-20704)

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to improper validation of the TLS server certificate that is received when establishing a connection to specific remote servers. A remote attacker can view or alter information that is shared between an affected device and specific Cisco servers , e.g. cloudsso.cisco.com and api.cisco.com.

11) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2022-20703)

The vulnerability allows an attacker to compromise the affected device.

The vulnerability exists due to improper cryptographic signature verification of software images as they are installed on an affected device.An attacker with physical access to device can install and boot a malicious software image or execute unsigned binaries on an affected device.

12) Improper Authorization (CVE-ID: CVE-2022-20702)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to missing authorization within the utility-ping-request script in the web-management interface. A local user can execute arbitrary code with elevated privileges.

13) Improper Authorization (CVE-ID: CVE-2022-20701)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to missing authorization in the web-management interface. A remote non-authenticated attacker can execute arbitrary code with root privileges.


14) Improper Authorization (CVE-ID: CVE-2022-20700)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to missing authorization in the web-management interface. A remote non-authenticated attacker can execute arbitrary code with root privileges.


Remediation

Install update from vendor's website.

References