CVE-2022-20801

Cisco Small Business RV340/RV345 Routers have web-based management interface vulnerabilities due to insufficient input validation that could let an authenticated attacker with admin privileges inject and execute arbitrary commands on the device’s Linux OS. Exploitation is network-based; successfu...

CVE-2022-20753

Cisco Small Business RV340/RV345 devices expose a web-based management interface vulnerable to remote code execution due to insufficient validation of attacker-supplied input. The issue manifests in the handling of JSON RPC requests (e.g., set-snmp) and related parameters, enabling an authenticat...

CVE-2022-20801: Improper Neutralization of Special Elements used in a Command

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. These vulnerabilities are due to...

CVE-2022-20799: Improper Neutralization of Special Elements used in a Command

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. These vulnerabilities are due to...

PT-2022-2470 · Cisco · Cisco Small Business R345P +3

Name of the Vulnerable Software and Affected Versions: Cisco Small Business RV340 and RV345 Routers affected versions not specified Cisco Small Business RV340W, RV345, and R345P Routers affected versions not specified Description: The issue is related to insufficient validation of user-supplied...

PT-2022-2469 · Cisco · Cisco Small Business Rv340W +3

Name of the Vulnerable Software and Affected Versions: Cisco Small Business RV340 and RV345 Routers affected versions not specified Cisco Small Business RV340W, RV345, and R345P affected versions not specified Description: The issue is related to insufficient validation of user-supplied input in...

Cisco Small Business RV Series Routers 操作系统命令注入漏洞

The Cisco Small Business RV Series Routers is an RV Series router from Cisco. The Cisco Small Business RV340 and RV345 Routers are vulnerable to an operating system command injection vulnerability that arises from insufficient validation of user-supplied input in the web-based management interfac...

CVE-2022-20753: Stack-based Buffer Overflow

A vulnerability in web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit...

The vulnerability of the web interface of Cisco Small Business RV340, RV340W, RV345, and RV345P router software allows a hacker to cause service interruptions.

The vulnerability of the web interface of Cisco Small Business RV340, RV340W, RV345, and RV345P microprogrammed software routers lies in the absence of restrictions on file loading. Exploiting this vulnerability can allow a malicious actor to cause service failures by loading arbitrary files onto...

The vulnerability of the SSL VPN microprogramming software for Cisco Small Business RV340, RV340W, RV345, and RV345P routers allows a hacker to execute arbitrary code.

The vulnerability of the SSL VPN microprogramming software for Cisco Small Business RV340, RV340W, RV345, and RV345P routers stems from an operation that occurs outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code with root privileges usin...

VulnCheck KEV: CVE-2022-20703

A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or...

(Pwn2Own) Cisco RV340 update-clients Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Cisco RV340 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling o...

(Pwn2Own) Cisco RV340 Firmware Update Missing Integrity Check Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Cisco RV340 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of firmware updates. The issue results from the lack of prope...

(Pwn2Own) Cisco RV340 NGINX sessionid Directory Traversal Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Cisco RV340 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the NGINX web server. When parsing the sessionid cooki...

(Pwn2Own) Cisco RV340 JSON RPC file-copy Command Injection Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Cisco RV340 routers. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of...

(Pwn2Own) Cisco RV340 Firmware Update Improper Certificate Validation Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Cisco RV340 routers. User interaction is required to exploit this vulnerability in that an administrator must perform a firmware update on the device. The specific flaw exists within the...

(Pwn2Own) Cisco RV340 utility-ping-request Insecure Temporary File Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Cisco RV340 routers. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

(Pwn2Own) Cisco RV340 confd_cli Unnecessary Privileges Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Cisco RV340 routers. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within confdcli. The...

(Pwn2Own) Cisco RV340 NGINX Improper Authentication Unrestricted File Upload Vulnerability

This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of Cisco RV340 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

(Pwn2Own) Cisco RV340 upload.cgi sessionid Improper Input Validation Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Cisco RV340 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the sessionid parameter provided to the upload.cgi endpoint...