CVE-2021-1472
MEDIUM EXPLOITED IN THE WILD NUCLEICisco RV Series Firmware - Unauthenticated RCE and Auth Bypass
Title source: llmExploitation Summary
CVE-2021-1472 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).
EIP tracks 1 public exploit from researchers including Takeshi Shiomitsu, jbaines-r7, including a Metasploit module exploits/linux/http/cisco_rv_series_authbypass_and_rce.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits an authentication bypass (CVE-2021-1472) and command injection (CVE-2021-1473) in Cisco Small Business RV series routers. It leverages a flawed credential verification in the /upload endpoint and injects commands via the HTTP Cookie field, achieving remote code execution as www-data.
Description
Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary commands or bypass authentication and upload files on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
Exploits (1)
This Metasploit module exploits an authentication bypass (CVE-2021-1472) and command injection (CVE-2021-1473) in Cisco Small Business RV series routers. It leverages a flawed credential verification in the /upload endpoint and injects commands via the HTTP Cookie field, achieving remote code execution as www-data.
Nuclei Templates (1)
http.html:"Cisco rv340" || http.html:"cisco rv340"
body="cisco rv340"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N