Multiple vulnerabilities in Cisco Small Business RV Series Routers

1) Improper Authorization

EUVDB-ID: #VU60247

Risk: Critical

CVSSv3.1: 9.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-20700

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to missing authorization in the web-management interface. A remote non-authenticated attacker can execute arbitrary code with root privileges.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

The vendor plans to release security patches in February 2022.

Vulnerable software versions

Cisco Small Business RV160 Series VPN Router: 1.0.00.13 - 1.0.01.05

Cisco Small Business RV160W Wireless-AC VPN Router: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260 VPN Router: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260P VPN Router with POE: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260W Wireless-AC VPN Router: 1.0.01.02 - 1.0.01.05

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper Authorization

EUVDB-ID: #VU60248

Risk: Critical

CVSSv3.1: 9.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-20701

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to missing authorization in the web-management interface. A remote non-authenticated attacker can execute arbitrary code with root privileges.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

The vendor plans to release security patches in February 2022.

Vulnerable software versions

Cisco Small Business RV160 Series VPN Router: 1.0.00.13 - 1.0.01.05

Cisco Small Business RV160W Wireless-AC VPN Router: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260 VPN Router: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260P VPN Router with POE: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260W Wireless-AC VPN Router: 1.0.01.02 - 1.0.01.05

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper Authorization

EUVDB-ID: #VU60249

Risk: Low

CVSSv3.1: 7.5 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-20702

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to missing authorization within the utility-ping-request script in the web-management interface. A local user can execute arbitrary code with elevated privileges.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

The vendor plans to release security patches in February 2022.

Vulnerable software versions

Cisco Small Business RV160 Series VPN Router: 1.0.00.13 - 1.0.01.05

Cisco Small Business RV160W Wireless-AC VPN Router: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260 VPN Router: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260P VPN Router with POE: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260W Wireless-AC VPN Router: 1.0.01.02 - 1.0.01.05

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D
http://www.zerodayinitiative.com/advisories/ZDI-22-420/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper Verification of Cryptographic Signature

EUVDB-ID: #VU60250

Risk: Low

CVSSv3.1: 7 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-20703

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

Exploit availability: No

Description

The vulnerability allows an attacker to compromise the affected device.

The vulnerability exists due to improper cryptographic signature verification of software images as they are installed on an affected device.An attacker with physical access to device can install and boot a malicious software image or execute unsigned binaries on an affected device.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

The vendor plans to release security patches in February 2022.

Vulnerable software versions

Cisco Small Business RV160 Series VPN Router: 1.0.00.13 - 1.0.01.05

Cisco Small Business RV160W Wireless-AC VPN Router: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260 VPN Router: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260P VPN Router with POE: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260W Wireless-AC VPN Router: 1.0.01.02 - 1.0.01.05

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper Certificate Validation

EUVDB-ID: #VU60251

Risk: Medium

CVSSv3.1: 5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-20704

CWE-ID: CWE-295 - Improper Certificate Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to improper validation of the TLS server certificate that is received when establishing a connection to specific remote servers. A remote attacker can view or alter information that is shared between an affected device and specific Cisco servers , e.g. cloudsso.cisco.com and api.cisco.com.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

The vendor plans to release security patches in February 2022.

Vulnerable software versions

Cisco Small Business RV160 Series VPN Router: 1.0.00.13 - 1.0.01.05

Cisco Small Business RV160W Wireless-AC VPN Router: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260 VPN Router: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260P VPN Router with POE: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260W Wireless-AC VPN Router: 1.0.01.02 - 1.0.01.05

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Improper Authentication

EUVDB-ID: #VU60252

Risk: High

CVSSv3.1: 8.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-20705

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in the session management of the web UI. A remote non-authenticated attacker can brute force to determine a current session identifier and then reuse it to take over an ongoing session or by crafting a new, valid session identifier and bypassing the whole authentication mechanism.

Successful exploitation of the vulnerability may allow an attacker to compromise the affected device.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

The vendor plans to release security patches in February 2022.

Vulnerable software versions

Cisco Small Business RV160 Series VPN Router: 1.0.00.13 - 1.0.01.05

Cisco Small Business RV160W Wireless-AC VPN Router: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260 VPN Router: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260P VPN Router with POE: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260W Wireless-AC VPN Router: 1.0.01.02 - 1.0.01.05

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) OS Command Injection

EUVDB-ID: #VU60253

Risk: Medium

CVSSv3.1: 7.6 [CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-20706

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the Open Plug and Play (PnP) module of Cisco Small Business RV Series Routers. A remote unauthenticated attacker can execute arbitrary commands on the underlying Linux operating system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system but requires a man-in-the-middle position or having an established foothold on a specific network device that is connected to the vulnerable router.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

The vendor plans to release security patches in February 2022.

Vulnerable software versions

Cisco Small Business RV160 Series VPN Router: 1.0.00.13 - 1.0.01.05

Cisco Small Business RV160W Wireless-AC VPN Router: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260 VPN Router: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260P VPN Router with POE: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260W Wireless-AC VPN Router: 1.0.01.02 - 1.0.01.05

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D
http://www.zerodayinitiative.com/advisories/ZDI-22-418/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Improper Handling of Exceptional Conditions

EUVDB-ID: #VU60258

Risk: Medium

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-20710

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to to erroneously handled exceptions during failed login attempts in the login functionality of the web-based management interface.. A remote non-authenticated attacker can send specially crafted HTTP requests to the affected device and prevent users from logging in.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

The vendor plans to release security patches in February 2022.

Vulnerable software versions

Cisco Small Business RV160 Series VPN Router: 1.0.00.13 - 1.0.01.05

Cisco Small Business RV160W Wireless-AC VPN Router: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260 VPN Router: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260P VPN Router with POE: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260W Wireless-AC VPN Router: 1.0.01.02 - 1.0.01.05

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Buffer overflow

EUVDB-ID: #VU60260

Risk: High

CVSSv3.1: 9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-20712

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTTP requests. A remote attacker can send a specially crafted HTTP request to the device, trigger memory corruption and execute arbitrary code on the target system with non-root privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

The vendor plans to release security patches in February 2022.

Vulnerable software versions

Cisco Small Business RV160 Series VPN Router: 1.0.00.13 - 1.0.01.05

Cisco Small Business RV160W Wireless-AC VPN Router: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260 VPN Router: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260P VPN Router with POE: 1.0.01.02 - 1.0.01.05

Cisco Small Business RV260W Wireless-AC VPN Router: 1.0.01.02 - 1.0.01.05

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-mult-vuln-KA9PK6D

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.