CVE-2021-1520: Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Local Privilege Escalation Vulnerability
First published: Thu May 06 2021(Updated: )
A vulnerability in the internal message processing of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated, local attacker to run arbitrary commands with root privileges on the underlying operating system (OS). This vulnerability exists because an internal messaging service does not properly sanitize input. An attacker could exploit this vulnerability by first authenticating to the device and then sending a crafted request to the internal service. A successful exploit could allow the attacker to run arbitrary commands with root privileges on the underlying OS. To exploit this vulnerability, the attacker must have valid Administrator credentials for the device.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Rv340 Firmware | <1.0.03.21 | |
| Cisco RV340 | ||
| Cisco Rv340w Firmware | <1.0.03.21 | |
| Cisco Rv340w | ||
| Cisco Rv345 Firmware | <1.0.03.21 | |
| Cisco Rv345 | ||
| Cisco Rv345p Firmware | <1.0.03.21 | |
| Cisco Rv345p |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Cisco RV340, RV340W, RV345, and RV345P vulnerability?
The vulnerability ID is CVE-2021-1520.
What is the severity level of CVE-2021-1520?
The severity level of CVE-2021-1520 is high.
How can an attacker exploit this vulnerability?
An authenticated, local attacker can exploit this vulnerability to run arbitrary commands with root privileges on the underlying operating system.
Is Cisco RV340, RV340W, RV345, and RV345P firmware affected by CVE-2021-1520?
Yes, Cisco RV340, RV340W, RV345, and RV345P firmware versions up to 1.0.03.21 are affected by CVE-2021-1520.
How can I fix this vulnerability?
Update your Cisco RV340, RV340W, RV345, and RV345P firmware to version 1.0.03.22 or later to fix this vulnerability.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/title
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/first-publish-date
- agent/description
- agent/event
- agent/tags
- vendor/cisco
- canonical/cisco rv340 firmware
- canonical/cisco rv340
- canonical/cisco rv340w firmware
- canonical/cisco rv340w
- canonical/cisco rv345 firmware
- canonical/cisco rv345
- canonical/cisco rv345p firmware
- canonical/cisco rv345p