Details of VAR-202102-0577

ID

VAR-202102-0577

CVE

CVE-2021-1348

TITLE

Multiple Cisco Product Access Control Error Vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202102-270

DESCRIPTION

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device

Trust: 0.99

sources: NVD: CVE-2021-1348 // VULMON: CVE-2021-1348

AFFECTED PRODUCTS

vendor:	cisco	model:	rv320 dual gigabit wan vpn router	scope:	lte	version:	1.5.1.11	Trust: 1.0
vendor:	cisco	model:	rv082 dual wan vpn router	scope:	lte	version:	4.2.3.14	Trust: 1.0
vendor:	cisco	model:	rv016 multi-wan vpn router	scope:	lte	version:	4.2.3.14	Trust: 1.0
vendor:	cisco	model:	rv325 dual gigabit wan vpn router	scope:	lte	version:	1.5.1.11	Trust: 1.0
vendor:	cisco	model:	rv042 dual wan vpn router	scope:	lte	version:	4.2.3.14	Trust: 1.0
vendor:	cisco	model:	rv042g dual gigabit wan vpn router	scope:	lte	version:	4.2.3.14	Trust: 1.0

sources: NVD: CVE-2021-1348

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-1348
value:	HIGH
Trust: 1.0
ykramarz@cisco.com:	CVE-2021-1348
value:	HIGH
Trust: 1.0
CNNVD:	CNNVD-202102-270
value:	HIGH
Trust: 0.6
VULMON:	CVE-2021-1348
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2021-1348
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.1

nvd@nist.gov:	CVE-2021-1348
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.1
Trust: 2.0

sources: VULMON: CVE-2021-1348 // CNNVD: CNNVD-202102-270 // NVD: CVE-2021-1348 // NVD: CVE-2021-1348

PROBLEMTYPE DATA

problemtype:

CWE-121

Trust: 1.0

sources: NVD: CVE-2021-1348

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202102-270

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-202102-270

PATCH

title:	Multiple Cisco Product access control error vulnerability fixes	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=140493	Trust: 0.6
title:	Cisco: Cisco Small Business RV Series Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities	url:	https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-rv-overflow-ghZP68yj	Trust: 0.1
title:	-	url:	https://www.theregister.co.uk/2021/02/05/cisco_critical_rv_vpn_router_bugs/	Trust: 0.1

sources: VULMON: CVE-2021-1348 // CNNVD: CNNVD-202102-270

EXTERNAL IDS

db:	NVD	id:	CVE-2021-1348	Trust: 1.7
db:	CNNVD	id:	CNNVD-202102-270	Trust: 0.6
db:	VULMON	id:	CVE-2021-1348	Trust: 0.1

sources: VULMON: CVE-2021-1348 // CNNVD: CNNVD-202102-270 // NVD: CVE-2021-1348

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-rv-overflow-ghzp68yj	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2021-1348	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/121.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://www.theregister.co.uk/2021/02/05/cisco_critical_rv_vpn_router_bugs/	Trust: 0.1

sources: VULMON: CVE-2021-1348 // CNNVD: CNNVD-202102-270 // NVD: CVE-2021-1348

SOURCES

db:	VULMON	id:	CVE-2021-1348
db:	CNNVD	id:	CNNVD-202102-270
db:	NVD	id:	CVE-2021-1348

LAST UPDATE DATE

2024-08-14T15:06:56.945000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2021-1348	date:	2021-02-05T00:00:00
db:	CNNVD	id:	CNNVD-202102-270	date:	2021-02-09T00:00:00
db:	NVD	id:	CVE-2021-1348	date:	2023-11-07T03:28:03.397

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2021-1348	date:	2021-02-04T00:00:00
db:	CNNVD	id:	CNNVD-202102-270	date:	2021-02-03T00:00:00
db:	NVD	id:	CVE-2021-1348	date:	2021-02-04T17:15:18.687