Critical Flaws Reported in Cisco VPN Routers for Businesses—Patch ASAP

Cisco has rolled out fixes for multiple critical vulnerabilities
in the web-based management interface of Small Business routers
that could potentially allow an unauthenticated, remote attacker to
execute arbitrary code as the root user on an affected device.

The flaws^[1]
— tracked from CVE-2021-1289 through CVE-2021-1295 (CVSS score 9.8)
— impact RV160, RV160W, RV260, RV260P, and RV260W VPN routers
running a firmware release earlier than Release 1.0.01.02.

Along with the aforementioned three vulnerabilities, patches
have also been released for two more arbitrary file write flaws^[2] (CVE-2021-1296 and
CVE-2021-1297) affecting the same set of VPN routers that could
have made it possible for an adversary to overwrite arbitrary files
on the vulnerable system.

All the nine security issues were reported to the networking
equipment maker by security researcher Takeshi Shiomitsu, who has
previously uncovered similar critical flaws^[3]
in RV110W, RV130W, and RV215W Routers that could be leveraged for
remote code execution (RCE) attacks.

While exact specifics of the vulnerabilities are still unclear,
Cisco said the flaws —

• CVE-2021-1289, CVE-2021-1290, CVE-2021-1291,
  CVE-2021-1292, CVE-2021-1293, CVE-2021-1294, and
  CVE-2021-1295 are a result of improper validation of HTTP
  requests, allowing an attacker to craft a specially-crafted HTTP
  request to the web-based management interface and achieve RCE.

• CVE-2021-1296 and CVE-2021-1297 are due to
  insufficient input validation, permitting an attacker to exploit
  these flaws using the web-based management interface to upload a
  file to a location that they should not have access to.

Separately, another set of five glitches^[4]
(CVE-2021-1314 through CVE-2021-1318) in the web-based management
interface of Small Business RV016, RV042, RV042G, RV082, RV320, and
RV325 routers could have granted an attacker the ability to inject
arbitrary commands on the routers that are executed with root
privileges.

Lastly, Cisco also addressed 30 additional vulnerabilities^[5] (CVE-2021-1319 through
CVE-2021-1348), affecting the same set of products, that could
allow an authenticated, remote attacker to execute arbitrary code
and even cause a denial-of-service condition.

“To exploit these vulnerabilities, an attacker would need to
have valid administrator credentials on the affected device,” Cisco
said in an advisory published on February 3.

Kai Cheng from the Institute of Information Engineering, which
is part of the Chinese Academy of Sciences, has been credited with
reporting the 35 flaws in the router management interface.

The company also noted there’s been no evidence of active
exploitation attempts in the wild for any of these flaws, nor are
there any workarounds that address the vulnerabilities.