Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Arbitrary File Write Vulnerabilities

Vulnerability

The web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers contains multiple arbitrary file write vulnerabilities (CVE-2021-1297). These issues stem from insufficient input validation, enabling an unauthenticated, remote attacker to conduct directory traversal attacks and overwrite files that should be restricted. Affected firmware versions are those prior to the fixed releases specified in the Cisco advisory [1].

Exploitation

An attacker can exploit these vulnerabilities by sending a specially crafted HTTP request to the web management interface, uploading a file to a directory traversal path that targets a location outside the intended upload directory. No authentication is required, and the attacker only needs network access to the management interface on the affected device [1].

Impact

Successful exploitation allows the attacker to overwrite arbitrary files on the device's filesystem. This could lead to denial of service, modification of device configuration, or potentially arbitrary code execution if critical system files are replaced. The impact depends on which files are overwritten, but the attacker can achieve significant compromise of the affected device [1].

Mitigation

Cisco has released free software updates to address these vulnerabilities. The fixed releases are detailed in the Cisco Security Advisory [1]. Customers should upgrade to the appropriate patched firmware version. No workarounds are available; the only mitigation is applying the firmware update. Devices that are end-of-life may not receive updates, and customers are advised to check the advisory for specific version information [1].