CVE-2021-1167
Assigner: cisco
Published: 2021-01-13T00:00:00
State: PUBLISHED
affected: product: Cisco Small Business RV Series Router Firmware 
vendor: Cisco
versions: status: affected
version: n/a
datePublic: 2021-01-13T00:00:00
descriptions: value: Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. The vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device. Cisco has not released software updates that address these vulnerabilities.
exploits: value: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities described in this advisory. 
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-121
description: CWE-121
type: CWE
source: advisory: cisco-sa-rv-overflow-WUnUgv4U
defect: CSCvv65098
CSCvv69398
CSCvv71463
CSCvv71466
CSCvv71467
CSCvv71468
CSCvv79107
CSCvv79109
CSCvv79110
CSCvv96729
CSCvv96730
CSCvv96732
CSCvv96733
CSCvv96738
CSCvv96741
CSCvv96742
CSCvv96747
CSCvv96748
CSCvv96751
CSCvv96755
CSCvv96756
CSCvv96757
CSCvv96758
CSCvv96759
CSCvv96761
CSCvv96762
CSCvv96763
CSCvv96764
CSCvv96765
CSCvv96767
CSCvv96768
CSCvv96771
CSCvv96772
CSCvv96799
CSCvv96800
CSCvv96801
CSCvv96806
CSCvv96807
CSCvv96809
CSCvv96810
CSCvv96811
CSCvv96812
CSCvv96814
CSCvv96817
CSCvv96818
CSCvv96820
CSCvw04678
CSCvw04779
CSCvw04781
CSCvw06813
CSCvw06828
CSCvw06832
CSCvw06841
CSCvw06846
CSCvw06852
CSCvw06860
CSCvw06865
CSCvw06868
CSCvw06873
CSCvw06874
CSCvw06879
CSCvw06880
CSCvw06882
CSCvw06894
CSCvw06900
CSCvw06902
CSCvw06950
CSCvw06958
CSCvw06961
CSCvw06962
CSCvw06967
CSCvw06971
CSCvw06978
CSCvw06981
CSCvw06982
CSCvw06987
CSCvw06991
CSCvw06992
CSCvw06993
CSCvw06998
CSCvw07002
CSCvw10473
CSCvw10484
CSCvw10487
CSCvw49030
CSCvw49034
CSCvw49036
CSCvw76488
CSCvw91642
discovery: INTERNAL
title: Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities