Cisco has released patches for three vulnerabilities across 11 of its small business routers, two of which are rated “critical”.
In an advisory, the networking giant said the vulnerabilities “could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition on an affected device”.
“The vulnerabilities are dependent on one another. Exploitation of one of the vulnerabilities may be required to exploit another vulnerability," Cisco noted.
“In addition, a software release that is affected by one of the vulnerabilities may not be affected by the other vulnerabilities.”
Two of the vulnerabilities, CVE-2022-20827 (CVSS score 9.0) and CVE-2022-20841 (CVSS score 8.3), affect nine devices in the RV160, RV260, RV340 and RV345 range.
CVE-2022-20842 (CVSS score 9.8) affects devices in the RV340 and RV345 range only.
CVE-2022-20842 is a bug in the web-based management interface of the affected dual-WAN gigabit VPN routers.
An attacker can send crafted HTTP input to access the affected unit.
“A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a DoS condition,” the advisory stated.
CVE-2022-20827 is a vulnerability in the web filter database update feature of affected devices.
“This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by submitting crafted input to the web filter database update feature," ”, the advisory stated.
"A successful exploit could allow the attacker to execute commands on the underlying operating system with root privileges."
Finally, CVE-2022-20841 is a bug in Open Plug-n-Play (PnP) module of affected devices.
It’s another input validation failure which, if exploited, could “allow the attacker to execute arbitrary commands on the underlying Linux operating system.
“To exploit this vulnerability, an attacker must leverage a man-in-the-middle position or have an established foothold on a specific network device that is connected to the affected router," Cisco said.
Singapore's Computer Emergency Response Team (SingCERT) advised customers to upgrade to the appropriate fixed software releases.
The company said that customers with service contracts are entitled to regular software updates and should obtain security fixes through their usual update channels.
Amit Roy Choudhury contributed to this report.
