CVE-2021-34730
Description
A vulnerability in the Universal Plug-and-Play (UPnP) service of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper validation of incoming UPnP traffic. An attacker could exploit this vulnerability by sending a crafted UPnP request to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a DoS condition. Cisco has not released software updates that address this vulnerability.
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco rv110w_wireless-n_vpn_firewall_firmware | No range specified | — |
| cisco application_extension_platform | 1.0.3.55 | — |
| cisco rv130_vpn_router_firmware | No range specified | — |
| cisco rv130w_wireless-n_multifunction_vpn_router_firmware | No range specified | — |
| cisco rv215w_wireless-n_vpn_router_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.