"Cisco Business Routers Found Vulnerable to Critical Remote Hacking Flaws"

Cisco has released patches to address eight security vulnerabilities, three of which could be used to gain Remote Code Execution (RCE) or cause a Denial-of-Service (DoS) condition on affected devices by an unauthenticated attacker. The most serious vulnerabilities affect Cisco Small Business RV160, RV260, RV340, and RV345 Series routers. The flaw, tracked as CVE-2022-20842 (CVSS score: 9.8), stems from insufficient validation of user-supplied input to the appliances' web-based management interface. A second flaw is a command injection vulnerability in the routers' web filter database update feature (CVE-2022-20827, CVSS score: 9.0), which could be exploited by an adversary to inject and execute arbitrary commands with root privileges on the underlying operating system. The third router-related flaw to be fixed (CVE-2022-20841, CVSS score: 8.0) is a command injection bug in the Open Plug-n-Play (PnP) module that could be exploited by sending malicious input to the targeted Linux host. An attacker must be in a man-in-the-middle position or have an established foothold on a specific network device connected to the affected router to exploit this vulnerability. This article continues to discuss the potential exploitation and severity of the flaws discovered in Cisco business routers. 

THN reports "Cisco Business Routers Found Vulnerable to Critical Remote Hacking Flaws"