CVE-2017-3882: Buffer Overflow
A vulnerability in the Universal Plug-and-Play (UPnP) implementation in the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, Layer 2-adjacent attacker to execute arbitrary code or cause a denial of service (DoS) condition. The remote code execution could occur with root privileges. The vulnerability is due to incomplete range checks of the UPnP input data, which could result in a buffer overflow. An attacker could exploit this vulnerability by sending a malicious request to the UPnP listening port of the targeted device. An exploit could allow the attacker to cause the device to reload or potentially execute arbitrary code with root privileges. This vulnerability affects all firmware releases of the Cisco CVR100W Wireless-N VPN Router prior to Firmware Release 1.0.1.22. Cisco Bug IDs: CSCuz72642.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3882?
CVE-2017-3882 has a high severity rating due to its potential for remote code execution and denial of service.
How do I fix CVE-2017-3882?
To fix CVE-2017-3882, upgrade your Cisco Small Business RV Router Firmware to the latest secure version.
What devices are affected by CVE-2017-3882?
CVE-2017-3882 affects multiple versions of the Cisco Small Business RV Router Firmware.
Can CVE-2017-3882 be exploited remotely?
Yes, CVE-2017-3882 allows an unauthenticated Layer 2-adjacent attacker to exploit the vulnerability.
What are the consequences of CVE-2017-3882?
Exploiting CVE-2017-3882 can lead to arbitrary code execution with root privileges or cause a denial of service condition.