Cisco Small Business Routers Vulnerable to Arbitrary Code Execution
CVE-2024-20518

9.1CRITICAL

Key Information:

Vendor
Cisco
Status
Cisco Small Business Rv Series Router Firmware
Vendor
CVE Published:
2 October 2024

Summary

A vulnerability exists in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers, allowing an authenticated, Admin-level attacker to execute arbitrary code as the root user. The issue is caused by improper validation of user-supplied input, enabling potential exploitation through crafted HTTP requests directed at the management interface. Successful exploitation enables the attacker to run arbitrary code on the device’s operating system, posing a significant security risk.

Affected Version(s)

Cisco Small Business RV Series Router Firmware 4.0.2.08-tm

Cisco Small Business RV Series Router Firmware 4.2.3.08

Cisco Small Business RV Series Router Firmware 4.1.1.01

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.