Cisco Small Business RV340 Series Routers Command Injection and Remote Code Execution Vulnerabilities

Vulnerability

The vulnerability resides in the web-based management interface of Cisco Small Business RV340 Series Routers (firmware versions prior to the fix). Specifically, the upload.cgi endpoint does not properly validate the fileparam parameter before using it in a system call, allowing command injection. This affects authenticated administrative users [1][2].

Exploitation

An attacker must have administrative credentials and be network-adjacent (CVSS attack vector: Adjacent Network). The attacker sends a crafted HTTP request to the upload.cgi endpoint with a malicious fileparam value. No user interaction is required. The lack of input validation leads to execution of arbitrary system commands [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the underlying operating system as the www-data user. This results in limited confidentiality, integrity, and availability impact (CVSS base score 5.5). The attacker gains restricted user-level access, not full root [1].

Mitigation

Cisco has released free software updates to address these vulnerabilities. Customers should upgrade to the latest firmware version available from Cisco [2]. No workarounds are documented. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.