CVE-2021-1296
Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Arbitrary File Write Vulnerabilities
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to conduct directory traversal attacks and overwrite certain files that should be restricted on an affected system. These vulnerabilities are due to insufficient input validation. An attacker could exploit these vulnerabilities by using the web-based management interface to upload a file to location on an affected device that they should not have access to. A successful exploit could allow the attacker to overwrite files on the file system of the affected device.
Múltiples vulnerabilidades en la interfaz de administración basada en web de los Enrutadores VPN Cisco Small Business RV160, RV160W, RV260, RV260P y RV260W, podrían permitir a un atacante remoto no autenticado llevar a cabo ataques de salto de directorio y sobrescriba ciertos archivos que deben restringirse en un sistema afectado. Estas vulnerabilidades son debido a una comprobación insuficiente de la entrada. Un atacante podría explotar estas vulnerabilidades mediante el uso de la interfaz de administración basada en web para cargar un archivo en la ubicación de un dispositivo afectado al que no debería tener acceso. Una explotación con éxito podría permitir al atacante sobrescribir archivos en el sistema de archivos del dispositivo afectado
This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of Cisco RV16x and RV26x routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the web service, which listens on TCP port 443 by default. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of root.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-11-13 CVE Reserved
- 2021-02-04 CVE Published
- 2024-05-22 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CWE-36: Absolute Path Traversal
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Cisco Search vendor "Cisco" | Rv160w Wireless-ac Vpn Router Firmware Search vendor "Cisco" for product "Rv160w Wireless-ac Vpn Router Firmware" | < 1.0.01.02 Search vendor "Cisco" for product "Rv160w Wireless-ac Vpn Router Firmware" and version " < 1.0.01.02" | - |
Affected
| in | Cisco Search vendor "Cisco" | Rv160w Wireless-ac Vpn Router Search vendor "Cisco" for product "Rv160w Wireless-ac Vpn Router" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Rv260 Vpn Router Firmware Search vendor "Cisco" for product "Rv260 Vpn Router Firmware" | < 1.0.01.02 Search vendor "Cisco" for product "Rv260 Vpn Router Firmware" and version " < 1.0.01.02" | - |
Affected
| in | Cisco Search vendor "Cisco" | Rv260 Vpn Router Search vendor "Cisco" for product "Rv260 Vpn Router" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Rv260p Vpn Router With Poe Firmware Search vendor "Cisco" for product "Rv260p Vpn Router With Poe Firmware" | < 1.0.01.02 Search vendor "Cisco" for product "Rv260p Vpn Router With Poe Firmware" and version " < 1.0.01.02" | - |
Affected
| in | Cisco Search vendor "Cisco" | Rv260p Vpn Router With Poe Search vendor "Cisco" for product "Rv260p Vpn Router With Poe" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Rv260w Wireless-ac Vpn Router Firmware Search vendor "Cisco" for product "Rv260w Wireless-ac Vpn Router Firmware" | < 1.0.01.02 Search vendor "Cisco" for product "Rv260w Wireless-ac Vpn Router Firmware" and version " < 1.0.01.02" | - |
Affected
| in | Cisco Search vendor "Cisco" | Rv260w Wireless-ac Vpn Router Search vendor "Cisco" for product "Rv260w Wireless-ac Vpn Router" | - | - |
Safe
|
| Cisco Search vendor "Cisco" | Rv160 Vpn Router Firmware Search vendor "Cisco" for product "Rv160 Vpn Router Firmware" | < 1.0.01.02 Search vendor "Cisco" for product "Rv160 Vpn Router Firmware" and version " < 1.0.01.02" | - |
Affected
| in | Cisco Search vendor "Cisco" | Rv160 Vpn Router Search vendor "Cisco" for product "Rv160 Vpn Router" | - | - |
Safe
|