CVE-2021-34730

critical · 9.8

A vulnerability in the Universal Plug-and-Play (UPnP) service of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper validation of incoming UPnP traffic. An attacker could exploit this vulnerability by sending a crafted UPnP request to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a DoS condition. Cisco has not released software updates that address this vulnerability.

9.8

CVSS

18.5%

EPSS (exploit prob.)

97th

EPSS percentile

2021-08-18

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-121CWE-787

Affected products

Vendor	Product	Affected versions
cisco	application_extension_platform	1.0.3.55
cisco	rv110w_wireless-n_vpn_firewall_firmware	all versions
cisco	rv110w_wireless-n_vpn_firewall	all versions
cisco	rv130_vpn_router_firmware	all versions
cisco	rv130_vpn_router	all versions
cisco	rv130w_wireless-n_multifunction_vpn_router_firmware	all versions
cisco	rv130w_wireless-n_multifunction_vpn_router	all versions
cisco	rv215w_wireless-n_vpn_router_firmware	all versions
cisco	rv215w_wireless-n_vpn_router	all versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-34730