Cisco Small Business RV Series Routers Multiple Vulnerabilities (cisco-sa-sb-mult-vuln-CbVp4SUR)

critical Nessus Plugin ID 163883

Language:

Synopsis

The remote device is missing a vendor-supplied security patch.

Description

According to its self-reported version, Cisco Small Business RV Series Router Firmware is affected by multiple vulnerabilities:

 - A vulnerability in the web filter database update feature of Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attacker to perform a command injection and execute commands on the underlying operating system with root privileges. (CVE-2022-20827)

 - A vulnerability in the Open Plug and Play (PnP) module of Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system. (CVE-2022-20841)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwb58268, CSCwb58273, CSCwb98961, CSCwb98964

See Also

http://www.nessus.org/u?93fea3b4

Plugin Details

Severity: Critical

ID: 163883

File Name: cisco-sa-sb-mult-vuln-CbVp4SUR.nasl

Version: 1.2

Type: remote

Family: CISCO

Published: 8/5/2022

Updated: 8/8/2022

Risk Information

VPR

Risk Factor: Critical

Score: 9.2

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 5.6

Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C

Temporal Vector: E:U/RL:OF/RC:C

CVSS Score Source: CVE-2022-20827

CVSS v3

Risk Factor: Critical

Base Score: 9

Temporal Score: 7.8

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:cisco:small_business_rv_series_router_firmware

Required KB Items: Cisco/Small_Business_Router/Version, Cisco/Small_Business_Router/Model

Exploit Ease: No known exploits are available

Patch Publication Date: 8/3/2022

Vulnerability Publication Date: 8/3/2022

Reference Information

CVE: CVE-2022-20827, CVE-2022-20841

CISCO-BUG-ID: CSCwb58268, CSCwb58273, CSCwb98961, CSCwb98964

CISCO-SA: cisco-sa-sb-mult-vuln-CbVp4SUR

IAVA: 2022-A-0308