Cisco Small Business RV Series Routers Link Layer Discovery Protocol Vulnerabilities
Description
Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business RV Series Routers. An unauthenticated, adjacent attacker could execute arbitrary code or cause an affected router to leak system memory or reload. A memory leak or device reload would cause a denial of service (DoS) condition on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. Note: LLDP is a Layer 2 protocol. To exploit these vulnerabilities, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Multiple LLDP implementation flaws in Cisco Small Business RV Series Routers allow unauthenticated, adjacent attackers to achieve remote code execution or cause denial of service.
Vulnerability
Multiple vulnerabilities exist in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Small Business RV Series Routers, identified as CVE-2021-1251 (along with related CVEs CVE-2021-1308 and CVE-2021-1309). The affected products include RV132W, RV134W, RV160, RV160W, RV260, RV260P, RV260W, RV320, RV325, RV340, RV340W, RV345, and RV345P routers running vulnerable firmware releases with LLDP enabled [1]. The bugs reside in how the device processes crafted LLDP packets, and no authentication is required to trigger them.
Exploitation
An unauthenticated attacker must be in the same Layer 2 broadcast domain as the affected device (i.e., adjacent) to send a specially crafted LLDP packet. The attacker does not need any prior credentials or user interaction. The specific steps involve crafting and transmitting malicious LLDP frames to the target router on the local network segment [1].
Impact
Successful exploitation can lead to arbitrary code execution on the router, a system memory leak, or a device reload. A memory leak or reload results in a denial of service (DoS) condition. Code execution would give the attacker full control of the device at the system level [1].
Mitigation
Cisco has released software updates that address these vulnerabilities. Affected users should upgrade their firmware to the fixed versions indicated in the Cisco Security Advisory [1]. There are no workarounds that mitigate the issue. The advisory does not list these CVEs in the Known Exploited Vulnerabilities (KEV) catalog.
AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2- Range: n/a
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-multi-lldp-u7e4chCemitrevendor-advisoryx_refsource_CISCO
News mentions
0No linked articles in our index yet.