Detections
Analytics
Cisco Small Business RV340 Series Routers Firmware < 1.0.03.19 Command Injection and RCE (cisco-sa-rv-osinj-rce-pwTkPCJv)
medium Nessus Plugin ID 140272
Language:
Synopsis
The remote device is missing a vendor-supplied security patchDescription
According to its self-reported version, Cisco Small Business RV Series Router Firmware is prior to 1.0.03.19. It is, therefore, affected by multiple vulnerabilities in the web-based management interface that can allow an authenicated, remote attacker with administrative credentials to execute arbitrary commands on the underlying operating system as a restricted user.Please see the included Cisco BIDs and Cisco Security Advisory for more information.
Solution
Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCvu40103, CSCvu49391See Also
http://www.nessus.org/u?35b3f57b
Plugin Details
Severity: Medium
ID: 140272
File Name: cisco-sa-rv-osinj-rce-pwTkPCJv.nasl
Version: 1.16
Type: remote
Family: CISCO
Published: 9/4/2020
Updated: 3/29/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.7
Temporal Score: 5.7
Vector: CVSS2#AV:A/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2020-3453
CVSS v3
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.9
Vector: CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: x-cpe:/o:cisco:small_business_rv_series_router_firmware
Required KB Items: Cisco/Small_Business_Router/Version, Cisco/Small_Business_Router/Model
Exploit Ease: No known exploits are available
Patch Publication Date: 9/2/2020
Vulnerability Publication Date: 9/2/2020
Reference Information
CVE: CVE-2020-3451, CVE-2020-3453