Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection Vulnerabilities

CVE-2023-20128

Summary

Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers, allowing an authenticated remote attacker to inject and execute arbitrary commands on the device's underlying operating system. These vulnerabilities arise from insufficient validation of user-supplied inputs, enabling attackers with valid Administrator credentials to exploit the flaws by submitting malicious input. A successful attack could grant unauthorized root access to the system, leading to severe security risks. As of now, Cisco has not provided any software updates to mitigate these vulnerabilities.

References