CVE-2021-1520

CWE-1235 documents5 sources
Severity
6.7MEDIUM
EPSS
0.0%
top 92.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Cisco Rv340 FirmwareCisco Rv340w FirmwareCisco Rv345 Firmware+2 more
Timeline
PublishedMay 6
Latest updateMay 24

Description

A vulnerability in the internal message processing of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated, local attacker to run arbitrary commands with root privileges on the underlying operating system (OS). This vulnerability exists because an internal messaging service does not properly sanitize input. An attacker could exploit this vulnerability by first authenticating to the device and then sending a crafted request to the internal service. A su…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages5 packages

▶NVDcisco/rv340w_firmware< 1.0.03.21
▶NVDcisco/rv345p_firmware< 1.0.03.21
▶NVDcisco/rv340_firmware< 1.0.03.21
▶NVDcisco/rv345_firmware< 1.0.03.21

🔴Vulnerability Details

2
GHSA
GHSA-4vxg-6hgq-qr48: A vulnerability in the internal message processing of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated↗2022-05-24
▶
CVEList
Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Local Privilege Escalation Vulnerability↗2021-05-06
▶

💥Exploits & PoCs

1
Nuclei
SAS/Internet 9.4 1520 - Local File Inclusion
▶

📋Vendor Advisories

1
Cisco
Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Local Privilege Escalation Vulnerability↗2021-05-05
▶
CVE-2021-1520 (MEDIUM CVSS 6.7) | A vulnerability in the internal mes | cvebase.io