CVE-2024-20518
published 2024-10-02CVE-2024-20518: A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated…
PriorityP261critical9.1CVSS 3.1
AVNACLPRHUINSCCHIHAH
EPSS
0.61%
45.5th percentile
A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to execute arbitrary code as the root user. To exploit this vulnerability, an attacker would need to have valid Administrator credentials on the affected device.
This vulnerability is due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system as the root user.
Affected
196 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit vector is crafted HTTP requests sent to the web-based management interface of affected Cisco Small Business routers (RV042, RV042G, RV320, RV325); monitor for anomalous or malformed HTTP requests targeting the management interface from authenticated administrator sessions. ↗
- →Successful exploitation results in arbitrary code execution as root on the underlying OS; monitor for unexpected root-level process spawning originating from the web management daemon on affected devices. ↗
- →Vulnerability is due to improper validation of user-supplied input (CWE-121/CWE-122 stack/heap buffer overflows) in the web-based management interface; focus detection on oversized or malformed input fields in HTTP POST/GET requests to the management interface. ↗
- →Exploitation requires valid Administrator credentials; correlate with any prior credential compromise or brute-force activity against the management interface before RCE attempts. ↗
- ·Exploitation requires authenticated Administrator-level access; attack surface is limited to sessions with valid admin credentials, reducing risk from unauthenticated external attackers but not from insider threats or credential-compromised accounts. ↗
- ·The advisory groups multiple CVEs under the same advisory (cisco-sa-sb-rv04x_rv32x_vulns-yJ2OSDhV) with shared Bug ID CSCwm48770; detections should account for the broader vulnerability cluster affecting RV042, RV042G, RV320, and RV325 device families. ↗
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
vendor_cisco6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Small Business RV042, RV042G, RV320, and RV325 Routers Denial of Service and Remote Code Execution Vulnerabilities
vendor_cisco·2024-10-02·CVSS 6.8
CVE-2024-20516 [MEDIUM] CWE-121 Cisco Small Business RV042, RV042G, RV320, and RV325 Routers Denial of Service and Remote Code Execution Vulnerabilities
Cisco Small Business RV042, RV042G, RV320, and RV325 Routers Denial of Service and Remote Code Execution Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow a remote attacker to execute arbitrary commands on the underlying operating system of an affected device or cause a denial of service (DoS) condition.
For more information about these vulnerabilities, see the Details section of this advisory.
Cisco has not released and will not release software updates that address these vulnerabilities because the affected products are past their respective dates for End of Software Maintenance Releases. The Cisco Product Security Incident Response Team (PSIRT) will continue to evaluate and disclose
Cisco
Cisco Small Business RV042, RV042G, RV320, and RV325 Routers Denial of Service and Remote Code Execution Vulnerabilities
vendor_cisco·CVSS 3.1
CVE-2024-20518 [MEDIUM] Cisco Small Business RV042, RV042G, RV320, and RV325 Routers Denial of Service and Remote Code Execution Vulnerabilities
CVE-2024-20518: Cisco Small Business RV042, RV042G, RV320, and RV325 Routers Denial of Service and Remote Code Execution Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow a remote attacker to execute arbitrary commands on the underlying operating system of an affected device or cause a denial of service (DoS) condition. For more information about these vulnerabilities, see the
Severity: medium
CVSS: 3.1
CWE: CWE-121, CWE-122, CWE-121, CWE-122
Bug IDs: CSCwm48770, CSCwm48770, CSCwm48770
GHSA
GHSA-3r3j-4cc8-xf5f: A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Ad
ghsa_unreviewed·2024-10-02
CVE-2024-20518 [MEDIUM] CWE-121 GHSA-3r3j-4cc8-xf5f: A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Ad
A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to execute arbitrary code as the root user. To exploit this vulnerability, an attacker would need to have valid Administrator credentials on the affected device.
This vulnerability is due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system as the root user.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2024-58075 kernel: crypto: tegra - do not transfer req when tegra init fails
bugzilla·2025-03-06·CVSS 5.5
CVE-2024-58075 [MEDIUM] CVE-2024-58075 kernel: crypto: tegra - do not transfer req when tegra init fails
CVE-2024-58075 kernel: crypto: tegra - do not transfer req when tegra init fails
In the Linux kernel, the following vulnerability has been resolved:
crypto: tegra - do not transfer req when tegra init fails
The tegra_cmac_init or tegra_sha_init function may return an error when
memory is exhausted. It should not transfer the request when they return
an error.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025030629-CVE-2024-58075-2f60@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2025:20095 https://access.redhat.com/errata/RHSA-2025:20095
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:20518 https://access.redhat.com/errata/RHSA-2025:20
Bugzilla
CVE-2024-58062 kernel: wifi: iwlwifi: mvm: avoid NULL pointer dereference
bugzilla·2025-03-06·CVSS 5.5
CVE-2024-58062 [MEDIUM] CVE-2024-58062 kernel: wifi: iwlwifi: mvm: avoid NULL pointer dereference
CVE-2024-58062 kernel: wifi: iwlwifi: mvm: avoid NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: avoid NULL pointer dereference
When iterating over the links of a vif, we need to make sure that the
pointer is valid (in other words - that the link exists) before
dereferncing it.
Use for_each_vif_active_link that also does the check.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025030609-CVE-2024-58062-00c9@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:20518 https://access.redhat.com/errata/RHSA-2025:20518
Bugzilla
CVE-2024-57990 kernel: wifi: mt76: mt7925: fix off by one in mt7925_load_clc()
bugzilla·2025-02-27·CVSS 7.8
CVE-2024-57990 [HIGH] CVE-2024-57990 kernel: wifi: mt76: mt7925: fix off by one in mt7925_load_clc()
CVE-2024-57990 kernel: wifi: mt76: mt7925: fix off by one in mt7925_load_clc()
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: fix off by one in mt7925_load_clc()
This comparison should be >= instead of > to prevent an out of bounds
read and write.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022638-CVE-2024-57990-67dc@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:20518 https://access.redhat.com/errata/RHSA-2025:20518
Bugzilla
CVE-2024-57987 kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek()
bugzilla·2025-02-27·CVSS 5.5
CVE-2024-57987 [MEDIUM] CVE-2024-57987 kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek()
CVE-2024-57987 kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek()
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btrtl: check for NULL in btrtl_setup_realtek()
If insert an USB dongle which chip is not maintained in ic_id_table, it
will hit the NULL point accessed. Add a null point check to avoid the
Kernel Oops.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022637-CVE-2024-57987-09a3@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2025:20095 https://access.redhat.com/errata/RHSA-2025:20095
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:20518 https://access.redhat.com/errata/RHSA-2025:20
Bugzilla
CVE-2024-57989 kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links
bugzilla·2025-02-27·CVSS 5.5
CVE-2024-57989 [MEDIUM] CVE-2024-57989 kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links
CVE-2024-57989 kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links
In mt7925_change_vif_links() devm_kzalloc() may return NULL but this
returned value is not checked.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022638-CVE-2024-57989-0a14@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2025:20095 https://access.redhat.com/errata/RHSA-2025:20095
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:20518 https://access.redhat.com/errata/RHSA-2025:20518
Bugzilla
CVE-2024-56603 kernel: net: af_can: do not leave a dangling sk pointer in can_create()
bugzilla·2024-12-27·CVSS 7.8
CVE-2024-56603 [HIGH] CVE-2024-56603 kernel: net: af_can: do not leave a dangling sk pointer in can_create()
CVE-2024-56603 kernel: net: af_can: do not leave a dangling sk pointer in can_create()
In the Linux kernel, the following vulnerability has been resolved:
net: af_can: do not leave a dangling sk pointer in can_create()
On error can_create() frees the allocated sk object, but sock_init_data()
has already attached it to the provided sock object. This will leave a
dangling sk pointer in the sock object and may cause use-after-free later.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024122703-CVE-2024-56603-3db8@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:20518 https://access.redhat.com/errata/RHSA-2025:20518
---
This issue has been addressed in the following products:
Red Hat Enterpris
Bugzilla
CVE-2024-56645 kernel: can: j1939: j1939_session_new(): fix skb reference counting
bugzilla·2024-12-27·CVSS 5.5
CVE-2024-56645 [MEDIUM] CVE-2024-56645 kernel: can: j1939: j1939_session_new(): fix skb reference counting
CVE-2024-56645 kernel: can: j1939: j1939_session_new(): fix skb reference counting
In the Linux kernel, the following vulnerability has been resolved:
can: j1939: j1939_session_new(): fix skb reference counting
Since j1939_session_skb_queue() does an extra skb_get() for each new
skb, do the same for the initial one in j1939_session_new() to avoid
refcount underflow.
[mkl: clean up commit message]
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024122738-CVE-2024-56645-bc11@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:20518 https://access.redhat.com/errata/RHSA-2025:20518
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9.6 Extended Update Support
V
2024-10-02
Published