Cisco fixes critical, high severity pre-auth flaws in VPN routers

guest · Aug 4, 2021

Cisco fixes critical, high severity pre-auth flaws in VPN routers
August 4. 2021
https://www.bleepingcomputer.com/ne...-high-severity-pre-auth-flaws-in-vpn-routers/

Cisco has addressed pre-auth security vulnerabilities impacting multiple Small Business VPN routers and allowing remote attackers to trigger a denial of service condition or execute commands and arbitrary code on vulnerable devices.

The two security flaws tracked as CVE-2021-1609 (rated 9.8/10) and CVE-2021-1602 (8.2/10) were found in the web-based management interfaces and exist due to improperly validated HTTP requests and insufficient user input validation, respectively.
Click to expand...

CVE-2021-1609 impacts RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN routers, while CVE-2021-1602 affects RV160, RV160W, RV260, RV260P, and RV260W VPN routers.

Luckily, as the company explains, the remote management feature is disabled by default on all affected VPN router models.

"The web-based management interface for these devices is available through local LAN connections by default and cannot be disabled there," Cisco says.
Click to expand...

Log in or Sign up

Cisco fixes critical, high severity pre-auth flaws in VPN routers

guest Guest

Log in or Sign up

Cisco fixes critical, high severity pre-auth flaws in VPN routers

guest Guest

Useful Searches