CVE-2021-1472
published 2021-04-08CVE-2021-1472: Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary…
PriorityP192critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
72.47%
99.4th percentile
Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary commands or bypass authentication and upload files on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | rv160_firmware | < 1.0.01.03 | 1.0.01.03 |
| cisco | rv160w_firmware | < 1.0.01.03 | 1.0.01.03 |
| cisco | rv260_firmware | < 1.0.01.03 | 1.0.01.03 |
| cisco | rv260p_firmware | < 1.0.01.03 | 1.0.01.03 |
| cisco | rv260w_firmware | < 1.0.01.03 | 1.0.01.03 |
| cisco | rv340_firmware | < 1.0.03.21 | 1.0.03.21 |
| cisco | rv340w_firmware | < 1.0.03.21 | 1.0.03.21 |
| cisco | rv345_firmware | < 1.0.03.21 | 1.0.03.21 |
| cisco | rv345p_firmware | < 1.0.03.21 | 1.0.03.21 |
| cisco | small_business_rv_series_routers | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor HTTP POST requests to the /upload endpoint on Cisco RV Series routers for command injection payloads embedded in the Cookie/sessionid field (e.g., backtick or $() subshell syntax). ↗
- →Alert on HTTP requests to /upload with a static or base64-encoded Authorization header (e.g., QUt6NkpTeTE6dmk4cW8=) that bypasses authentication on affected Cisco RV340/RV345 devices. ↗
- →Detect multipart/form-data POST requests to /upload containing form fields 'option', 'destination', 'file.path', 'filename', and a file upload — characteristic of exploitation attempts against this CVE. ↗
- →Shodan/FOFA exposure: devices presenting 'Cisco rv340' in HTTP response body are likely affected targets; use as a hunting pivot. ↗
- →Successful exploitation results in code execution as 'www-data'; look for anomalous www-data process spawning (e.g., wget, curl, shell) on Cisco RV340/RV345 devices. ↗
- ·Vulnerability affects RV16X/RV26X firmware versions 1.0.01.02 and below, and RV34X firmware versions 1.0.03.20 and below. Devices on newer firmware are not affected. ↗
- ·The Metasploit module specifically targets RV340, RV340W, RV345, and RV345P models; other RV series models may be affected by related CVEs but not this specific exploit path. ↗
- ·CVE-2021-1472 (auth bypass) and CVE-2021-1473 (command injection) are chained together in exploitation; both must be present for full unauthenticated RCE. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck5.3MEDIUM
vendor_oracle10.0MEDIUM
vendor_cisco7.3HIGH
vendor_redhat7.1HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: Linux kernel: integer overflow and information disclosure via undefined shift operation in drm/amdkfd
vendor_redhat·2025-10-01·CVSS 7.1
CVE-2021-4460 [HIGH] CWE-1335 kernel: Linux kernel: integer overflow and information disclosure via undefined shift operation in drm/amdkfd
kernel: Linux kernel: integer overflow and information disclosure via undefined shift operation in drm/amdkfd
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Fix UBSAN shift-out-of-bounds warning
If get_num_sdma_queues or get_num_xgmi_sdma_queues is 0, we end up
doing a shift operation where the number of bits shifted equals
number of bits in the operand. This behaviour is undefined.
Set num_sdma_queues or num_xgmi_sdma_queues to ULLONG_MAX, if the
count is >= number of bits in the operand.
Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1472
A flaw was found in the Linux kernel’s AMD Kernel Fusion Driver (amdkfd) within the drm subsystem. When either get_num_sdma_queues() or get_num_xgmi_sdma_queues() returned 0, the driver performed a bit shift wher
Oracle
Oracle Oracle Systems Risk Matrix: Operating System Image — CVE-2020-1472
vendor_oracle·2021-04-15·CVSS 10.0
CVE-2020-1472 [MEDIUM] Oracle Oracle Systems Risk Matrix: Operating System Image — CVE-2020-1472
Oracle Oracle Systems Risk Matrix: Operating System Image vulnerability
CVE: CVE-2020-1472
CVSS: 10.0
Protocol: Multiple
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2021 (APR 2021)
Cisco
Cisco Small Business RV Series Routers Vulnerabilities
vendor_cisco·2021-04-07·CVSS 7.3
CVE-2021-1472 [HIGH] CWE-119 Cisco Small Business RV Series Routers Vulnerabilities
Cisco Small Business RV Series Routers Vulnerabilities
Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary commands or bypass authentication and upload files on an affected device.
For more information about these vulnerabilities, see the Details section of this advisory.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv-bypass-inject-Rbhgvfdx
Cisco
Cisco Small Business RV Series Routers Vulnerabilities
vendor_cisco·CVSS 3.1
CVE-2021-1472 Cisco Small Business RV Series Routers Vulnerabilities
CVE-2021-1472: Cisco Small Business RV Series Routers Vulnerabilities
Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary commands or bypass authentication and upload files on an affected device. For more information about these vulnerabilities, see the
CVSS: 3.1
CWE: CWE-119, CWE-284, CWE-119, CWE-284
Bug IDs: CSCvw92538, CSCvw92718, CSCvw92723, CSCvw92538, CSCvw92718
GHSA
GHSA-9f7f-qvqp-2hf3: Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers
ghsa_unreviewed·2022-05-24
CVE-2021-1472 [CRITICAL] CWE-119 GHSA-9f7f-qvqp-2hf3: Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers
Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary commands or bypass authentication and upload files on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
VulnCheck
Cisco RV Series Routers Improper Restriction of Operations within the Bounds of a Memory Buffer
vulncheck·2021·CVSS 5.3
CVE-2021-1472 [MEDIUM] Cisco RV Series Routers Improper Restriction of Operations within the Bounds of a Memory Buffer
Cisco RV Series Routers Improper Restriction of Operations within the Bounds of a Memory Buffer
Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary commands or bypass authentication and upload files on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
Affected: Cisco RV Series Routers
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://vblocalhost.com/uploads/VB2021-50.pdf; https://media.defense.gov/2024/Sep/18/2003547016/-1/-1/0/CSA-PRC-LINKED-ACTORS-BOTNET.PDF
No detection rules found.
Nuclei
Cisco Small Business RV Series - OS Command Injection
nuclei·CVSS 9.8
CVE-2021-1472 [CRITICAL] Cisco Small Business RV Series - OS Command Injection
Cisco Small Business RV Series - OS Command Injection
Cisco Small Business RV Series routers RV16X/RV26X versions 1.0.01.02 and before and RV34X versions 1.0.03.20 and before contain multiple OS command injection vulnerabilities in the web-based management interface. A remote attacker can execute arbitrary OS commands via the sessionid cookie or bypass authentication and upload files on an affected device.
Template:
id: CVE-2021-1472
info:
name: Cisco Small Business RV Series - OS Command Injection
author: gy741
severity: critical
description: |
Cisco Small Business RV Series routers RV16X/RV26X versions 1.0.01.02 and before and RV34X versions 1.0.03.20 and before contain multiple OS command injection vulnerabilities in the web-based management interface. A remote attacker can execute
Metasploit
Cisco Small Business RV Series Authentication Bypass and Command Injection
metasploit·CVSS 9.8
CVE-2021-1472 [CRITICAL] Cisco Small Business RV Series Authentication Bypass and Command Injection
Cisco Small Business RV Series Authentication Bypass and Command Injection
This module exploits an authentication bypass (CVE-2021-1472) and command injection (CVE-2021-1473) in the Cisco Small Business RV series of VPN/routers. The device does not adequately verify the credentials in the HTTP Authorization field when requests are made to the /upload endpoint. Then the upload.cgi binary will use the contents of the HTTP Cookie field as part of a `curl` request aimed at an internal endpoint. The curl request is executed using `popen` and allows the attacker to inject commands via the Cookie field. A remote and unauthenticated attacker using this module is able to achieve code execution as `www-data`. This module affects the RV340, RV340w, RV345, and RV345P using firmware versions 1.0.03.20
Greynoiseio
NoiseLetter October 2025
blogs_greynoiseio
NoiseLetter October 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Bugzilla
CVE-2021-4460 kernel: Linux kernel: integer overflow and information disclosure via undefined shift operation in drm/amdkfd
bugzilla·2025-10-01·CVSS 7.1
CVE-2021-4460 [HIGH] CVE-2021-4460 kernel: Linux kernel: integer overflow and information disclosure via undefined shift operation in drm/amdkfd
CVE-2021-4460 kernel: Linux kernel: integer overflow and information disclosure via undefined shift operation in drm/amdkfd
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Fix UBSAN shift-out-of-bounds warning
If get_num_sdma_queues or get_num_xgmi_sdma_queues is 0, we end up
doing a shift operation where the number of bits shifted equals
number of bits in the operand. This behaviour is undefined.
Set num_sdma_queues or num_xgmi_sdma_queues to ULLONG_MAX, if the
count is >= number of bits in the operand.
Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1472
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025100114-CVE-2021-4460-aa71@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterpri
http://packetstormsecurity.com/files/162238/Cisco-RV-Authentication-Bypass-Code-Execution.htmlhttp://seclists.org/fulldisclosure/2021/Apr/39https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv-bypass-inject-Rbhgvfdxhttp://packetstormsecurity.com/files/162238/Cisco-RV-Authentication-Bypass-Code-Execution.htmlhttp://seclists.org/fulldisclosure/2021/Apr/39https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv-bypass-inject-Rbhgvfdx
2021-04-08
Published
Exploited in the wild