SB2023011149 - OS command injection in Cisco Small Business RV160 and RV260 Series VPN Routers

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023011149

SB2023011149 - OS command injection in Cisco Small Business RV160 and RV260 Series VPN Routers

Published: January 11, 2023

Security Bulletin ID SB2023011149
CSH Severity
Low
Patch available
NO
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) OS Command Injection (CVE-ID: CVE-2023-20045)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the web-based management interface . A remote privileged user can send a specially crafted HTTP request to the affected device and execute arbitrary OS commands on the target system with root privileges.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References