ZDI-22-411: (Pwn2Own) Cisco RV340 upload.cgi JSON Command Injection Privilege Escalation Vulnerability
This vulnerability allows network-adjacent attackers to escalate privileges on affected installations of Cisco RV340 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of POST request parameters provided to the upload.cgi endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the www-data user.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco RV340W Firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of ZDI-22-411?
The severity of ZDI-22-411 is rated as high due to the potential for privilege escalation on affected Cisco RV340 routers.
How do I fix ZDI-22-411?
To fix ZDI-22-411, update your Cisco RV340 firmware to the latest version that addresses this vulnerability.
What type of attacks can be executed through the ZDI-22-411 vulnerability?
ZDI-22-411 allows network-adjacent attackers to escalate privileges on affected Cisco RV340 routers.
Is authentication required to exploit ZDI-22-411?
Yes, authentication is required to exploit ZDI-22-411, but the existing mechanism can be bypassed.
Which devices are impacted by ZDI-22-411?
ZDI-22-411 specifically impacts Cisco RV340 routers with affected firmware.
- agent/references
- agent/type
- agent/softwarecombine
- agent/title
- agent/severity
- agent/description
- agent/source
- agent/tags
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-22-411
- alias/ZDI-CAN-15883
- alias/CVE-2022-20707
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/event
- vendor/cisco
- canonical/cisco rv340w firmware