CVE-2021-1290 — Vulnetix

CVE-2021-1290 PUBLISHED CVSS 9.800000190734863 CRITICAL

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as the root user on an affected device. These vulnerabilities exist because HTTP requests are not properly validated. An attacker could exploit these vulnerabilities by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to remotely execute arbitrary code on the device.

EPSS 1.87% · 83.5th percentile

Risk Scores

CVSS 3.1

9.800000190734863

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

1.87%

83.5th percentile

Affected Products

Vendor	Product	Versions
cisco	rv260p_vpn_router_with_poe_firmware	0
cisco	rv160_vpn_router_firmware	0
cisco	rv160w_wireless-ac_vpn_router_firmware	0
cisco	rv260w_wireless-ac_vpn_router_firmware	0
Cisco	Cisco Small Business RV Series Router Firmware	n/a
cisco	rv260_vpn_router_firmware	0

Exploit Intelligence

20210203 Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Remote Code Execution Vulnerabilities (circl)

Timeline

Feb 3, 2021 CVE Published
Apr 14, 2021 EPSS Score
Jun 23, 2021 EPSS Score
Aug 24, 2021 EPSS Score
Dec 27, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 4, 2022 EPSS Score
Feb 28, 2022 EPSS Score
May 1, 2022 EPSS Score
Jul 3, 2022 EPSS Score
Sep 4, 2022 EPSS Score
Nov 6, 2022 EPSS Score

References

Open in Interactive Console →