CVE-2021-1151

CWE-79 — Cross-site Scripting (XSS)CWE-416 — Use After Free6 documents5 sources
Severity
4.8MEDIUM
EPSS
0.0%
top 90.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Cisco Cisco Small Business RV Series Router FirmwareCisco Application Extension PlatformCisco Rv110w Firmware+3 more
Timeline
PublishedJan 13
Latest updateMay 24

Description

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. The vulnerabilities are due to insufficient input validation by the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attac…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages6 packages

▶NVDcisco/rv130w_firmware1.2.2.8, 1.3.1.7+1
▶NVDcisco/rv110w_firmware1.2.2.8, 1.3.1.7+1
▶NVDcisco/rv130_vpn_router_firmware1.2.2.8, 1.3.1.7+1

🔴Vulnerability Details

2
GHSA
GHSA-4crf-hf39-p7m7: Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authen↗2022-05-24
▶
CVEList
Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Stored Cross-Site Scripting Vulnerabilities↗2021-01-13
▶

📋Vendor Advisories

3
Red Hat
gnutls: Use after free in client_send_params in lib/ext/pre_shared_key.c↗2021-03-12
▶
Red Hat
gnutls: Use after free in client key_share extension↗2021-03-12
▶
Cisco
Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Stored Cross-Site Scripting Vulnerabilities↗2021-01-13
▶
CVE-2021-1151 (MEDIUM CVSS 4.8) | Multiple vulnerabilities in the web | cvebase.io