CVE-2022-20799— Cisco Small Business RV Series Routers 操作系统命令注入漏洞

Cisco Small Business RV Series Routers Command Injection Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. These vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by sending malicious input to an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system of the affected device. To exploit these vulnerabilities, an attacker would need to have valid Administrator credentials on the affected device.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

在命令中使用的特殊元素转义处理不恰当(命令注入)

Cisco Small Business RV Series Routers 操作系统命令注入漏洞

Cisco Small Business RV Series Routers是美国思科（Cisco）公司的一款RV系列路由器。 Cisco Small Business RV340 and RV345 Routers 存在操作系统命令注入漏洞，该漏洞源于基于 Web 的管理界面对用户提供的输入的验证不充分。经过身份验证的远程攻击者利用此漏洞可在受影响设备的底层操作系统上注入和执行任意命令。

N/A

N/A