CVE-2021-1414 — Deserialization of Untrusted Data in Cisco Rv340 Firmware

CWE-502 — Deserialization of Untrusted DataCWE-416 — Use After Free7 documents6 sources
Severity
6.3MEDIUMNVD
EPSS
0.9%
top 23.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Cisco Rv340 FirmwareCisco Rv340w FirmwareCisco Rv345 Firmware+2 more
Timeline
PublishedApr 8
Latest updateFeb 26

Description

Multiple vulnerabilities in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to execute arbitrary code with elevated privileges equivalent to the web service process on an affected device. These vulnerabilities exist because HTTP requests are not properly validated. An attacker could exploit these vulnerabilities by sending a crafted HTTP request to the web-based management interface of an affe…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LExploitability: 2.8 | Impact: 3.4

Affected Packages5 packages

▶NVDcisco/rv340w_firmware< 1.0.03.21
▶NVDcisco/rv345p_firmware< 1.0.03.21
▶NVDcisco/rv340_firmware< 1.0.03.21
▶NVDcisco/rv345_firmware< 1.0.03.21

🔴Vulnerability Details

2
GHSA
GHSA-8hgh-7cf7-366x: Multiple vulnerabilities in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an a↗2022-05-24
▶
CVEList
Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Authenticated Remote Code Execution Vulnerabilities↗2021-04-08
▶

📋Vendor Advisories

2
Red Hat
kernel: ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl↗2025-02-26
▶
Cisco
Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Authenticated Remote Code Execution Vulnerabilities↗2021-04-07
▶

🕵️Threat Intelligence

2
Talos
Vulnerability Spotlight: Vulnerability in Apple iOS, iPad OS and MacOS could lead to disclosure of sensitive memory data↗2022-01-25
▶
Talos
Vulnerability Spotlight: Vulnerability in Apple iOS, iPad OS and MacOS could lead to disclosure of sensitive memory data↗2022-01-25
▶
CVE-2021-1414 — Deserialization of Untrusted Data | cvebase