Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. These vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by sending malicious input to an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system of the affected device. To exploit these vulnerabilities, an attacker would need to have valid Administrator credentials on the affected device.
References
Link | Resource |
---|---|
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-rv-cmd-inj-8Pv9JMJD | Vendor Advisory |
Configurations
Configuration 1 (hide)
AND |
|
Configuration 2 (hide)
AND |
|
Configuration 3 (hide)
AND |
|
Configuration 4 (hide)
AND |
|
History
24 Jul 2023, 13:33
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-78 |
11 May 2022, 19:57
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-77 | |
CPE | cpe:2.3:h:cisco:rv345:-:*:*:*:*:*:*:* cpe:2.3:o:cisco:rv345p_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:cisco:rv340w_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:cisco:rv345_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:cisco:rv340_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:cisco:rv340w:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:rv345p:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:rv340:-:*:*:*:*:*:*:* |
|
References | (CISCO) https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-rv-cmd-inj-8Pv9JMJD - Vendor Advisory | |
First Time |
Cisco rv345 Firmware
Cisco rv340 Firmware Cisco rv340w Cisco rv340 Cisco rv345p Cisco rv345p Firmware Cisco Cisco rv345 Cisco rv340w Firmware |
|
CVSS |
v2 : v3 : |
v2 : 9.0
v3 : 7.2 |
04 May 2022, 18:15
Type | Values Removed | Values Added |
---|---|---|
Summary | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. These vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by sending malicious input to an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system of the affected device. To exploit these vulnerabilities, an attacker would need to have valid Administrator credentials on the affected device. |
04 May 2022, 17:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-05-04 17:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-20799
Mitre link : CVE-2022-20799
CVE.ORG link : CVE-2022-20799
JSON object : View
Products Affected
cisco
- rv340w_firmware
- rv345
- rv340w
- rv345p
- rv340_firmware
- rv340
- rv345_firmware
- rv345p_firmware