Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Web Management Vulnerabilities

Vulnerability

CVE-2021-1610 is a command injection vulnerability in the web-based management interface of the Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers. The vulnerability arises because HTTP requests sent to the management interface are not properly validated. An authenticated attacker can leverage this flaw to inject arbitrary commands. Affected software releases are those prior to the fixed version released by Cisco [1].

Exploitation

An attacker must have valid administrative credentials to authenticate to the web-based management interface. With authenticated access, the attacker sends a crafted HTTP request containing the malicious command payload to an affected device. The request is not properly validated, leading to command injection. No user interaction beyond authentication is required [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands with root privileges on the affected router. This compromises the confidentiality, integrity, and availability of the device, potentially leading to full device compromise, data exfiltration, or further network attacks [1].

Mitigation

Cisco has released software updates to address this vulnerability. Administrators should upgrade to the fixed firmware version as indicated in the security advisory [1]. There are no workarounds available. The vulnerability is not known to be listed in CISA's Known Exploited Vulnerabilities (KEV) catalog at this time.