CVE-2023-20073

published 2023-04-05

CVE-2023-20073: A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated…

Priority P1 95 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV Initial access

A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to insufficient authorization enforcement mechanisms in the context of file uploads. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to upload arbitrary files to the affected device.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
cisco	cisco_small_business_rv_series_router_firmware	—	—
cisco	rv340_firmware	<= 1.0.03.29	—
cisco	rv340_rv340w_rv345_and_rv345p_dual_wan_gigabit_vpn_routers	—	—
cisco	rv340w_firmware	<= 1.0.03.29	—
cisco	rv345_firmware	<= 1.0.03.29	—
cisco	rv345p_firmware	<= 1.0.03.29	—

Detection & IOCs extracted from sources · hover to see the quote

url /api/operations/ciscosb-file:form-file-upload

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Cisco RV Series Router form-file-upload Stored Cross Site Scripting Attempt (CVE-2023-20073)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:45; content:"/api/operations/ciscosb-file:form-file-upload"; fast_pattern; http.request_body; content:"Content-Disposition|3a 20|form-data|3b 20|name|3d 22|pathparam|22|"; content:"Portal"; within:20; content:"Content-Disposition|3a 20|form-data|3b 20|name|3d 22|fileparam|22|"; content:"login.html"; within:20; content:"Content-Disposition|3a 20|form-data|3b 20|name|3d 22|file|22 3b|"; content:"filename|3d 22|login.html|22|"; within:30; pcre:"/^.*(?:on(?:(?:error)|(?:s(?:elec|ubmi)|rese)t|d(?:blclick|ragdrop)|(?:mouse|key)[a-z]|c(?:hange|lick)|(?:un)?load|focus|blur)|s(?:cript|tyle))(?:=|%3[dD])?/Ri"; reference:url,www.iotsec-zone.com/article/383; reference:cve,2023-20073; classtype:web-application-attack; sid:2063621; rev:1; metadata:affected_product Cisco_RV_Series, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_07_21, cve CVE_2023_20073, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2025_07_21, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

• → Detect unauthenticated POST requests to the vulnerable file upload endpoint /api/operations/ciscosb-file:form-file-upload with a URI byte size of exactly 45 characters.
• → The exploit uses a multipart form-data body containing a 'pathparam' field set to 'Portal', a 'fileparam' field, and a 'file' field with a filename — all three must be present to match the attack pattern.
• → The exploit sets the HTTP Authorization header to the literal value '1' (not a valid credential) to bypass authorization checks — flag POST requests to the upload endpoint with this anomalous Authorization header value.
• → The Nuclei PoC template verifies exploitation by uploading a file to the Portal path and then performing a GET on /index.html to confirm the injected content is reflected — monitor for this GET-after-POST pattern on the same host.
• → FOFA fingerprint queries for affected devices: use 'app="CISCO-RV340"', 'app="CISCO-RV340W"', 'app="CISCO-RV345"', or 'app="CISCO-RV345P"' to identify exposed targets.
• → The Snort/ET rule uses a PCRE to detect XSS payloads (event handlers or script/style tags) within the uploaded file body, indicating the attacker may be uploading malicious HTML/JS files for stored XSS.

• · There are no workarounds available for this vulnerability; patching is the only mitigation. ↗
• · The vulnerability is due to insufficient authorization enforcement in the file upload context — the endpoint accepts uploads without valid authentication, meaning network-level ACLs blocking unauthenticated access to the management interface are the primary compensating control. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vulncheck 5.3 MEDIUM

vendor_cisco 5.3 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434