CVE-2021-1335
published 2021-02-04CVE-2021-1335: Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an…
PriorityP351high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
2.75%
84.5th percentile
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | rv016_multi-wan_vpn_router_firmware | <= 4.2.3.14 | — |
| cisco | rv042_dual_wan_vpn_router_firmware | <= 4.2.3.14 | — |
| cisco | rv042g_dual_gigabit_wan_vpn_router_firmware | <= 4.2.3.14 | — |
| cisco | rv082_dual_wan_vpn_router_firmware | <= 4.2.3.14 | — |
| cisco | rv320_dual_gigabit_wan_vpn_router_firmware | <= 1.5.1.11 | — |
| cisco | rv325_dual_gigabit_wan_vpn_router_firmware | <= 1.5.1.11 | — |
| cisco | small_business_rv_series_routers | — | — |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
vendor_redhat8.8HIGH
vendor_cisco7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: Linux kernel: integer overflow and information disclosure via undefined shift operation in drm/amdkfd
vendor_redhat·2025-10-01·CVSS 7.1
CVE-2021-4460 [HIGH] CWE-1335 kernel: Linux kernel: integer overflow and information disclosure via undefined shift operation in drm/amdkfd
kernel: Linux kernel: integer overflow and information disclosure via undefined shift operation in drm/amdkfd
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Fix UBSAN shift-out-of-bounds warning
If get_num_sdma_queues or get_num_xgmi_sdma_queues is 0, we end up
doing a shift operation where the number of bits shifted equals
number of bits in the operand. This behaviour is undefined.
Set num_sdma_queues or num_xgmi_sdma_queues to ULLONG_MAX, if the
count is >= number of bits in the operand.
Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1472
A flaw was found in the Linux kernel’s AMD Kernel Fusion Driver (amdkfd) within the drm subsystem. When either get_num_sdma_queues() or get_num_xgmi_sdma_queues() returned 0, the driver performed a bit shift wher
Red Hat
kernel: gpio: wcd934x: Fix shift-out-of-bounds error
vendor_redhat·2024-05-21·CVSS 5.5
CVE-2021-47263 [MEDIUM] CWE-1335 kernel: gpio: wcd934x: Fix shift-out-of-bounds error
kernel: gpio: wcd934x: Fix shift-out-of-bounds error
In the Linux kernel, the following vulnerability has been resolved:
gpio: wcd934x: Fix shift-out-of-bounds error
bit-mask for pins 0 to 4 is BIT(0) to BIT(4) however we ended up with BIT(n - 1)
which is not right, and this was caught by below usban check
UBSAN: shift-out-of-bounds in drivers/gpio/gpio-wcd934x.c:34:14
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Not affected
Package: kernel (Red Hat Enterprise Linux 9) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 9) - Not
Red Hat
expat: Large number of prefixed XML attributes on a single tag can crash libexpat
vendor_redhat·2022-01-17·CVSS 8.8
CVE-2021-45960 [HIGH] CWE-1335 expat: Large number of prefixed XML attributes on a single tag can crash libexpat
expat: Large number of prefixed XML attributes on a single tag can crash libexpat
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
expat (libexpat) is susceptible to a software flaw that causes process interruption. When processing a large number of prefixed XML attributes on a single tag can libexpat can terminate unexpectedly due to buffer overrun. The highest threat from this vulnerability is to availability.
Statement: Red Hat Product Security has rated this CVE based on the configurations of a default install in the context of SELinux enforcement and services run as non privileged users.
Package: expat (Red Hat Enterprise Linux
Cisco
Cisco Small Business RV Series Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities
vendor_cisco·2021-02-03·CVSS 7.2
CVE-2021-1319 [HIGH] CWE-121 Cisco Small Business RV Series Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities
Cisco Small Business RV Series Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly.
These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (Do
Cisco
Cisco Small Business RV Series Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities
vendor_cisco·CVSS 3.1
CVE-2021-1335 Cisco Small Business RV Series Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities
CVE-2021-1335: Cisco Small Business RV Series Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial
GHSA
GHSA-xxcc-4hjx-8q5v: Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could all
ghsa_unreviewed·2022-05-24
CVE-2021-1335 [HIGH] CWE-121 GHSA-xxcc-4hjx-8q5v: Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could all
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affect
No detection rules found.
No public exploits indexed.
2021-02-04
Published