Vulnerability · Published Apr 8, 2021 · Assigned by cisco

CVE-2021-1472Cisco Small Business RV Series Routers Vulnerabilities

Medium 5.3

In plain English

A medium-severity memory corruption in Cisco Small Business RV Series Router Firmware from Cisco. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 72.0% (higher than 99.4% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)72.0%top 0.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling2Metasploit, Nuclei

Official description

Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary commands or bypass authentication and upload files on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco Small Business RV Series Router Firmware	n/a

Weakness: CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

20210407 Cisco Small Business RV Series Routers Vulnerabilities vendor-advisory, x_refsource_CISCO
20210419 [CVE-2021-1472/CVE-2021-1473] Cisco RV Series Authentication Bypass and Remote Command Execution mailing-list, x_refsource_FULLDISC
http://packetstormsecurity.com/files/162238/Cisco-RV-Authentication-Bypass-Code-Execution.html x_refsource_MISC