Networking equipment major Cisco has rolled out patches to
address critical vulnerabilities impacting its Small Business VPN
routers that could be abused by a remote attacker to execute
arbitrary code and even cause a denial-of-service (DoS)
condition.
The issues, tracked as CVE-2021-1609 (CVSS score: 9.8) and
CVE-2021-1610 (CVSS score: 7.2), reside in the web-based management
interface of the Small Business RV340, RV340W, RV345, and RV345P
Dual WAN Gigabit VPN Routers running a firmware release prior to
version 1.0.03.22. Both the issues stem from a lack of proper
validation of HTTP requests, thus permitting a bad actor to send a
specially-crafted HTTP request to a vulnerable device.
Successful exploitation of CVE-2021-1609 could allow an
unauthenticated, remote attacker to execute arbitrary code on the
device or cause the device to reload, resulting in a DoS condition.
CVE-2021-1610, concerns a command injection vulnerability that, if
exploited, could permit an authenticated adversary to remotely
execute arbitrary commands with root privileges on an affected
device, the company noted[1]
in its advisory.
Swing of Chaitin Security Research Lab has been credited with
reporting the two shortcomings.
Also addressed by Cisco is a high-severity remote code execution
bug (CVE-2021-1602, CVSS score: 8.2) impacting Small Business
RV160, RV160W, RV260, RV260P, and RV260W VPN Routers that could be
leveraged by an unauthenticated, remote attacker to execute
arbitrary commands on the underlying operating system of an
affected device. Small Business RV Series Routers running firmware
versions earlier than 1.0.01.04 are susceptible.
“This vulnerability is due to insufficient user input
validation. An attacker could exploit this vulnerability by sending
a crafted request to the web-based management interface,” Cisco
said[2]. “A successful exploit
could allow the attacker to execute arbitrary commands on an
affected device using root-level privileges. Due to the nature of
the vulnerability, only commands without parameters can be
executed.”
The company noted there’s been no evidence of active
exploitation attempts in the wild for any of these flaws, nor are
there any workarounds that address the vulnerabilities.
CVE-2021-1602 marks the second time Cisco has fixed critical
remote code execution flaws concerning the same set of VPN
appliances. Earlier this February, the company patched 35 flaws[3]
that could potentially allow an unauthenticated, remote attacker to
execute arbitrary code as the root user on an affected device.