CVE-2021-1602CWE-78

Cisco Small Business RV160 and RV260 Series VPN Routers Remote Command Execution Vulnerability

High · published August 4, 2021

CVSS v3.1
8.2
EPSS
2%
Percentile
80.9
In the wild
Unconfirmed
What it is

A vulnerability in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on an affected device using root-level privileges. Due to the nature of the vulnerability, only commands without parameters can be executed.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.02033 · 80.9th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2021-08-04T17:20Z
EPSS history
Timeline
  • 04 AUG 17:20Z
    Cisco Small Business RV160 and RV260 Series VPN Routers Remote Command Execution Vulnerability
    cvelistv5