Cisco RV340 set_snmp usmUserAuthKey Command Injection Remote Code Execution Vulnerability
Discription

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Cisco RV340 routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of JSON-RPC requests. When parsing the usmUserAuthKey property, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the www-data user.Read More

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv34x-rce-8bfG2h6b

6.5 Medium

CVSS2

  • Access Complexity
  • Access Vector
  • Authentication
  • Availability Impact
  • Confidentiality Impact
  • Integrity Impact
  • Low
  • Network
  • Single
  • Partial
  • Partial
  • Partial

AV:N/AC:L/Au:S/C:P/I:P/A:P

6.3 Medium

CVSS3

  • Attack Complexity
  • Attack Vector
  • Availability Impact
  • Confidentiality Impact
  • Integrity Impact
  • Privileges Required
  • Scope
  • User Interaction
  • Low
  • Network
  • Low
  • Low
  • Low
  • Low
  • Unchanged
  • None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Back to Main
Subscribe for the latest news: