Cisco addressed critical flaws in Small Business VPN routers

Cisco fixes critical remote code execution vulnerability, tracked as CVE-2022-20842, impacting Small Business VPN routers.

Cisco addressed a critical security vulnerability, tracked as CVE-2022-20842, impacting Small Business VPN routers.

The flaw resides in the web-based management interface of several Small Business VPN routers, including Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers. An unauthenticated, remote attacker can exploit the flaw to execute arbitrary code or trigger a denial of service (DoS) condition by causing an affected device to restart unexpectedly.

“This vulnerability is due to insufficient validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP input to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a DoS condition.” reads the advisory published by the company.

The flaw received a CVSS Score of 9.8, the IT giant pointed out that there are no workarounds that address this vulnerability.

Cisco also fixed a vulnerability, tracked as CVE-2022-20827, in the web filter database update feature of Cisco Small Business that could allow an unauthenticated, remote attacker to perform a command injection and execute commands on the underlying operating system with root privileges.

The issue affects RV160, RV260, RV340, and RV345 Series Routers, it received a CVSS Score of 9.0.

“This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by submitting crafted input to the web filter database update feature. A successful exploit could allow the attacker to execute commands on the underlying operating system with root privileges.” reads the advisory.

Cisco has fixed critical security vulnerabilities affecting Small Business VPN routers and enabling unauthenticated, remote attackers to execute arbitrary code or commands and trigger denial of service (DoS) conditions on vulnerable devices.

The third issue addressed by Cisco is a command injection vulnerability, tracked as CVE-2022-20841, in the Open Plug and Play (PnP) module of Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers.

An unauthenticated, remote attacker can exploit the flaw to inject and execute arbitrary commands on the underlying operating system.

The company’s Product Security Incident Response Team (PSIRT) revealed it is unaware of active exploitation or publicly available exploits in the wild.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Small Business VPN routers)

[adrotate banner=”5″]

[adrotate banner=”13″]