Cross-Site Scripting Vulnerability in Cisco Small Business RV042 and RV042G VPN Routers

Summary

A flaw in the web-based management interface of Cisco Small Business RV042 Dual WAN VPN Routers and RV042G Dual Gigabit WAN VPN Routers allows remote attackers to perform cross-site scripting (XSS) attacks. This vulnerability arises from inadequate validation of user input in the management interface, enabling attackers to execute arbitrary script code. By tricking an interface user into clicking a specially crafted link, an attacker can gain access to sensitive browser information or manipulate the front-end interface. Cisco has issued software updates to mitigate this vulnerability, and no workarounds are available.

References