Cisco Small Business Routers Vulnerability Could Allow Arbitrary Code Execution

CVE-2024-20520

Summary

A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers allows an authenticated, Administrator-level, remote attacker to execute arbitrary code as the root user. This issue arises from inadequate validation of user-supplied input, enabling an attacker with valid Administrator credentials to send specially crafted HTTP requests to the device. If successfully exploited, the attacker could execute code on the underlying operating system with elevated privileges, posing significant risks to network security.

References