CVE-2021-1296 — Vulnetix

CVE-2021-1296 PUBLISHED CVSS 7.5 HIGH

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to conduct directory traversal attacks and overwrite certain files that should be restricted on an affected system. These vulnerabilities are due to insufficient input validation. An attacker could exploit these vulnerabilities by using the web-based management interface to upload a file to location on an affected device that they should not have access to. A successful exploit could allow the attacker to overwrite files on the file system of the affected device.

EPSS 0.44% · 63.8th percentile

Risk Scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Score

0.44%

63.8th percentile

Affected Products

Vendor	Product	Versions
cisco	rv260w_wireless-ac_vpn_router_firmware	0
cisco	rv260_vpn_router_firmware	0
cisco	rv260p_vpn_router_with_poe_firmware	0
cisco	rv160w_wireless-ac_vpn_router_firmware	0
Cisco	Cisco Small Business RV Series Router Firmware	n/a
cisco	rv160_vpn_router_firmware	0

Exploit Intelligence

20210203 Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Arbitrary File Write Vulnerabilities (circl)

Timeline

Feb 3, 2021 CVE Published
Apr 14, 2021 EPSS Score
Jun 23, 2021 EPSS Score
Aug 24, 2021 EPSS Score
Dec 27, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 4, 2022 EPSS Score
Feb 28, 2022 EPSS Score
Apr 1, 2022 EPSS Score
Jul 3, 2022 EPSS Score
Sep 4, 2022 EPSS Score
Nov 6, 2022 EPSS Score

References

Open in Interactive Console →