Rewterz Threat Advisory –CVE-2021-34730 – Cisco Small Business Routers Vulnerability

Severity

High

Analysis Summary

CVE-2021-34730

A vulnerability in the Universal Plug-and-Play (UPnP) service of Cisco Small Business Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly, resulting in a denial of service (DoS) condition.This vulnerability is due to improper validation of incoming UPnP traffic. An attacker could exploit this vulnerability by sending a crafted UPnP request to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a DoS condition.

Impact

• Code Execution
• Denial of Service
• Unauthorized Access

Affected Vendors

Cisco

Affected Products

• Cisco Small Business RV Series Routers RV110W Wireless-N VPN Firewalls
• Cisco Small Business RV Series Routers RV130 VPN Routers
• RV130W Wireless-N Multifunction VPN Routers
• Cisco Small Business RV Series Routers RV215W Wireless-N VPN Routers

Remediation

Refer to Cisco Security Advisory for the patch, upgrade, or suggested workaround information.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cisco-sb-rv-overflow-htpymMB5