Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-34730

A vulnerability in the Universal Plug-and-Play (UPnP) service of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper validation of incoming UPnP traffic. An attacker could exploit this vulnerability by sending a crafted UPnP request to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a DoS condition. Cisco has not released software updates that address this vulnerability.

Published

2021-08-18T20:15:07.447

Last Modified

2024-11-21T06:11:04.170

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

10.0

Impact Score

10.0

Weaknesses
  • Type: Secondary
    CWE-121
  • Type: Primary
    CWE-787
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application cisco application_extension_platform 1.0.3.55 Yes
Operating System cisco rv110w_wireless-n_vpn_firewall_firmware - Yes
Hardware cisco rv110w_wireless-n_vpn_firewall - No
Operating System cisco rv130_vpn_router_firmware - Yes
Hardware cisco rv130_vpn_router - No
Operating System cisco rv130w_wireless-n_multifunction_vpn_router_firmware - Yes
Hardware cisco rv130w_wireless-n_multifunction_vpn_router - No
Operating System cisco rv215w_wireless-n_vpn_router_firmware - Yes
Hardware cisco rv215w_wireless-n_vpn_router - No
References