Cisco Small Business RV042, RV042G, RV320, and RV325 Remote Command Execution Vulnerabilities

Vulnerability

CVE-2024-20519 is a vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers. The issue stems from improper validation of user-supplied input in the web-based management interface. All software releases for these models at the time of publication are affected [1]. An attacker must have valid Administrator-level credentials to reach the vulnerable code path.

Exploitation

An authenticated Administrator-level remote attacker can exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected device. The attacker must have valid Administrator credentials and network access to the management interface [1]. The exploitation does not require additional user interaction beyond the initial authentication.

Impact

Successful exploitation allows the attacker to execute arbitrary code on the underlying operating system as the root user. This grants full control over the device, enabling complete compromise of confidentiality, integrity, and availability [1].

Mitigation

Cisco has not released and will not release software updates that address this vulnerability because the affected products are past their respective End of Software Maintenance Releases dates. Cisco Small Business RV042, RV042G, RV320, and RV325 Routers have reached end-of-life (EOL) status. There are no workarounds that address this vulnerability. The Cisco PSIRT recommends upgrading to a non-vulnerable product [1].