Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Cisco Patches Critical Vulnerability in Small Business VPN Routers

Cisco on Wednesday announced the release of patches for a critical vulnerability in small business VPN routers that could allow unauthenticated attackers to execute arbitrary code on affected devices.

Cisco on Wednesday announced the release of patches for a critical vulnerability in small business VPN routers that could allow unauthenticated attackers to execute arbitrary code on affected devices.

Tracked as CVE-2021-1609 (CVSS score 9.8), the issue was discovered in the web interface of RV340, RV340W, RV345, and RV345P routers and exists because HTTP requests are not properly validated.

To exploit the bug, a remote, unauthenticated attacker has to send specially crafted HTTP requests to an affected device, which could allow them to execute arbitrary code or cause a denial of service (DoS) condition.

“[T]he web management interface is locally accessible by default and cannot be disabled, but is not enabled for remote management by default. However, based on queries via BinaryEdge, we’ve confirmed there are at least 8,850 remotely accessible devices,” Satnam Narang, staff research engineer at Tenable, commented.

CVE-2021-1610, a second vulnerability addressed in the same devices, could result in an attacker executing arbitrary commands as root. While exploitation is similar to the critical vulnerability, authentication is required for a successful attack, which lowers the bug’s severity rating to high.

The two vulnerabilities can be exploited independently of one another, Cisco says. The company has released patches for both issues and says that it’s not aware of any malicious attacks exploiting them.

“Organizations that use these Cisco Small Business VPN routers and have exposed their management interface externally can address these flaws by patching their devices. If patching is not feasible at this time, disabling the remote management option on these devices will mitigate the flaws until patches can be applied,” Narang said.

On Wednesday, Cisco released patches for a series of other high-severity vulnerabilities as well, including a remote command execution issue in RV160, RV160W, RV260, RV260P, and RV260W VPN routers, a DLL injection bug in Packet Tracer for Windows, a command injection flaw in Network Services Orchestrator, and a privilege escalation issue in ConfD.

Related: Code Execution Flaw Found in Cisco Firepower Device Manager On-Box Software

Related: Cisco Patches High Severity Vulnerabilities in BPA, WSA

Related: Cisco Plugs High-Risk Security Flaws in Webex, SD-WAN

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Vulnerabilities

Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.

Vulnerabilities

Several vulnerabilities have been patched in OpenText’s enterprise content management (ECM) product.