CVE-2020-3358

published 2020-07-16

CVE-2020-3358: A vulnerability in the Secure Sockets Layer (SSL) VPN feature for Cisco Small Business RV VPN Routers could allow an unauthenticated, remote attacker to cause…

Priority P3 48 high 8.6 CVSS 3.1

AV N AC L PR N UI N S C C N I N A H

A vulnerability in the Secure Sockets Layer (SSL) VPN feature for Cisco Small Business RV VPN Routers could allow an unauthenticated, remote attacker to cause the device to unexpectedly restart, causing a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request over an SSL connection to the targeted device. A successful exploit could allow the attacker to cause a reload, resulting in a DoS condition.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
cisco	cisco_small_business_rv_series_router_firmware	—	—
cisco	rv340_dual_wan_gigabit_vpn_router_firmware	< 1.0.03.18	1.0.03.18
cisco	rv340_rv340w_rv345_and_rv345p_dual_wan_gigabit_vpn_routers_ssl	—	—
cisco	rv340w_dual_wan_gigabit_wireless-ac_vpn_router_firmware	< 1.0.03.18	1.0.03.18
cisco	rv345_dual_wan_gigabit_vpn_router_firmware	< 1.0.03.18	1.0.03.18
cisco	rv345p_dual_wan_gigabit_poe_vpn_router_firmware	< 1.0.03.18	1.0.03.18

CVSS provenance

nvd v3.1 8.6 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

nvd v2.0 7.8 HIGH AV:N/AC:L/Au:N/C:N/I:N/A:C

vendor_cisco 8.6 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20