CVE-2024-20362

Vulnerability

The web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers contains a cross-site scripting (XSS) vulnerability due to insufficient input validation [1]. This affects all firmware versions of these router models. The vulnerability exists in the management interface that processes user-supplied input without proper sanitization.

Exploitation

An unauthenticated, remote attacker can exploit this vulnerability by persuading a user to visit specially crafted web pages that include malicious payloads [1]. The attacker does not require any prior authentication or network access beyond the ability to deliver a link to the victim. The user must interact with the crafted page while logged into the router's management interface.

Impact

Successful exploitation allows the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information such as session tokens or cookies [1]. The attacker gains the same privileges as the victim user within the management interface.

Mitigation

Cisco has not released a firmware update to address this vulnerability [1]. The only mitigations involve disabling remote management and blocking access to ports 443 and 60443 on the WAN interface. For RV320 and RV325 routers, disabling remote management is sufficient. For RV016, RV042, RV042G, and RV082 routers, additionally block ports 443 and 60443 [1]. Detailed configuration steps are provided in the Cisco advisory.