CVE-2021-1293

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as the root user on an affected device. These vulnerabilities exist because HTTP requests are not properly validated. An attacker could exploit these vulnerabilities by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to remotely execute arbitrary code on the device.

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as the root user on an affected device. These vulnerabilities exist because HTTP requests are not properly validated. An attacker could exploit these vulnerabilities by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to remotely execute arbitrary code on the device.

Múltiples vulnerabilidades en la interfaz de administración basada en web de los Enrutadores VPN Cisco Small Business RV160, RV160W, RV260, RV260P y RV260W, podrían permitir a un atacante remoto no autenticado ejecutar código arbitrario como usuario root en un dispositivo afectado. Estas vulnerabilidades se presentan porque las peticiones HTTP no son comprobadas apropiadamente. Un atacante podría explotar estas vulnerabilidades mediante el envío de una petición HTTP diseñada hacia la interfaz de administración basada en web de un dispositivo afectado. Una explotación con éxito podría permitir al atacante ejecutar código arbitrario remotamente en el dispositivo