CVE-2021-1296

Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Arbitrary File Write Vulnerabilities

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to conduct directory traversal attacks and overwrite certain files that should be restricted on an affected system. These vulnerabilities are due to insufficient input validation. An attacker could exploit these vulnerabilities by using the web-based management interface to upload a file to location on an affected device that they should not have access to. A successful exploit could allow the attacker to overwrite files on the file system of the affected device.

Múltiples vulnerabilidades en la interfaz de administración basada en web de los Enrutadores VPN Cisco Small Business RV160, RV160W, RV260, RV260P y RV260W, podrían permitir a un atacante remoto no autenticado llevar a cabo ataques de salto de directorio y sobrescriba ciertos archivos que deben restringirse en un sistema afectado. Estas vulnerabilidades son debido a una comprobación insuficiente de la entrada. Un atacante podría explotar estas vulnerabilidades mediante el uso de la interfaz de administración basada en web para cargar un archivo en la ubicación de un dispositivo afectado al que no debería tener acceso. Una explotación con éxito podría permitir al atacante sobrescribir archivos en el sistema de archivos del dispositivo afectado

This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of Cisco RV16x and RV26x routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the web service, which listens on TCP port 443 by default. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of root.

*Credits: T Shiomitsu

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

None

Automatable

Yes

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2020-11-13 CVE Reserved
2021-02-04 CVE Published
2024-05-22 EPSS Updated
2024-11-08 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-36: Absolute Path Traversal

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv160-260-filewrite-7x9mnKjn	2023-11-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Cisco Search vendor "Cisco"	Rv160w Wireless-ac Vpn Router Firmware Search vendor "Cisco" for product "Rv160w Wireless-ac Vpn Router Firmware"	< 1.0.01.02 Search vendor "Cisco" for product "Rv160w Wireless-ac Vpn Router Firmware" and version " < 1.0.01.02"	-	Affected	in	Cisco Search vendor "Cisco"	Rv160w Wireless-ac Vpn Router Search vendor "Cisco" for product "Rv160w Wireless-ac Vpn Router"	-	-	Safe
Cisco Search vendor "Cisco"	Rv260 Vpn Router Firmware Search vendor "Cisco" for product "Rv260 Vpn Router Firmware"	< 1.0.01.02 Search vendor "Cisco" for product "Rv260 Vpn Router Firmware" and version " < 1.0.01.02"	-	Affected	in	Cisco Search vendor "Cisco"	Rv260 Vpn Router Search vendor "Cisco" for product "Rv260 Vpn Router"	-	-	Safe
Cisco Search vendor "Cisco"	Rv260p Vpn Router With Poe Firmware Search vendor "Cisco" for product "Rv260p Vpn Router With Poe Firmware"	< 1.0.01.02 Search vendor "Cisco" for product "Rv260p Vpn Router With Poe Firmware" and version " < 1.0.01.02"	-	Affected	in	Cisco Search vendor "Cisco"	Rv260p Vpn Router With Poe Search vendor "Cisco" for product "Rv260p Vpn Router With Poe"	-	-	Safe
Cisco Search vendor "Cisco"	Rv260w Wireless-ac Vpn Router Firmware Search vendor "Cisco" for product "Rv260w Wireless-ac Vpn Router Firmware"	< 1.0.01.02 Search vendor "Cisco" for product "Rv260w Wireless-ac Vpn Router Firmware" and version " < 1.0.01.02"	-	Affected	in	Cisco Search vendor "Cisco"	Rv260w Wireless-ac Vpn Router Search vendor "Cisco" for product "Rv260w Wireless-ac Vpn Router"	-	-	Safe
Cisco Search vendor "Cisco"	Rv160 Vpn Router Firmware Search vendor "Cisco" for product "Rv160 Vpn Router Firmware"	< 1.0.01.02 Search vendor "Cisco" for product "Rv160 Vpn Router Firmware" and version " < 1.0.01.02"	-	Affected	in	Cisco Search vendor "Cisco"	Rv160 Vpn Router Search vendor "Cisco" for product "Rv160 Vpn Router"	-	-	Safe