CVE-2021-1147
Assigner: cisco
Published: 2021-01-13T00:00:00
State: PUBLISHED
affected: product: Cisco Small Business RV Series Router Firmware 
vendor: Cisco
versions: status: affected
version: n/a
datePublic: 2021-01-13T00:00:00
descriptions: value: Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to a targeted device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on an affected device. Cisco has not released software updates that address these vulnerabilities.
exploits: value: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory. 
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-20
description: CWE-20
type: CWE
source: advisory: cisco-sa-rv-command-inject-LBdQ2KRN
defect: CSCvv96723
CSCvv96725
CSCvv96726
CSCvv96727
CSCvw49751
CSCvw49774
CSCvw49777
discovery: INTERNAL
title: Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Command Injection Vulnerabilities