CVE-2023-20073: Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Arbitrary File Upload Vulnerability
First published: Wed Apr 05 2023(Updated: )
A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to insufficient authorization enforcement mechanisms in the context of file uploads. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to upload arbitrary files to the affected device.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Rv340 Firmware | <=1.0.03.29 | |
| Cisco RV340 | ||
| Cisco Rv340w Firmware | <=1.0.03.29 | |
| Cisco Rv340w | ||
| Cisco Rv345 Firmware | <=1.0.03.29 | |
| Cisco Rv345 | ||
| Cisco Rv345p Firmware | <=1.0.03.29 | |
| Cisco Rv345p |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-20073.
What is the severity of CVE-2023-20073?
The severity of CVE-2023-20073 is critical.
Which Cisco products are affected by CVE-2023-20073?
Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers are affected by CVE-2023-20073.
How can an attacker exploit CVE-2023-20073?
An attacker can exploit CVE-2023-20073 by uploading arbitrary files to the affected device through the web-based management interface.
Is authentication required to exploit CVE-2023-20073?
No, authentication is not required to exploit CVE-2023-20073.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/references
- agent/last-modified-date
- agent/title
- agent/weakness
- agent/severity
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/cisco
- canonical/cisco rv340 firmware
- version/cisco rv340 firmware/1.0.03.29
- canonical/cisco rv340
- canonical/cisco rv340w firmware
- version/cisco rv340w firmware/1.0.03.29
- canonical/cisco rv340w
- canonical/cisco rv345 firmware
- version/cisco rv345 firmware/1.0.03.29
- canonical/cisco rv345
- canonical/cisco rv345p firmware
- version/cisco rv345p firmware/1.0.03.29
- canonical/cisco rv345p