Cisco fixes critical, high severity vulnerabilities in VPN routers

Cisco fixed critical, high severity pre-auth security vulnerabilities impacting multiple Small Business VPN routers.

Cisco addressed critical and high severity pre-auth security vulnerabilities that impact multiple Small Business VPN routers.

An attacker could exploit the issues to trigger a denial of service condition or execute commands and arbitrary code on impacted multiple Small Business VPN routers.

The two vulnerabilities, tracked as CVE-2021-1609 and CVE-2021-1602, resides in the web-based management interfaces. Both flaws could be exploited by a remote, unauthenticated attacker without any user interaction, just by

CVE-2021-1609 affects the Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers, it received a CVSS score of 9.8.

“This vulnerability exists because HTTP requests are not properly validated. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to remotely execute arbitrary code on the device or cause the device to reload, resulting in a DoS condition.” reads the advisory.

The CVE-2021-1602 affects RV160, RV160W, RV260, RV260P, and RV260W VPN routers, it received a CVSS score of 8.2.

“This vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface.” states the advisory.

Cisco pointed out that the remote management feature is disabled by default on the impacted VPN routers.

“The web-based management interface for these devices is available through local LAN connections by default and cannot be disabled there. The interface can also be made available through the WAN interface by enabling the remote management feature. By default, the remote management feature is disabled on affected devices.” continues the advisory.

The IT giant says no workarounds are available to secure the devices, the Product Security Incident Response Team (PSIRT) is not aware of attacks in the wild exploiting the above flaws.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, VPN routers)

[adrotate banner=”5″]

[adrotate banner=”13″]