CVE-2023-20025

Critical

Description

A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, and RV082 Routers could allow an unauthenticated, remote attacker to bypass authentication on an affected device. This vulnerability is due to improper validation of user input within incoming HTTP packets. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface. A successful exploit could allow the attacker to bypass authentication and gain root access on the underlying operating system.

SeverityCritical
CVSS9.0
Exploit probability—
ProductCisco Rv016 Firmware
PublishedJan 20, 2023
First seenJan 20, 2023
Weakness typeCWE-293CWE-293

How to fix

Sources list no fixed version or patch link for this vulnerability.

Affected products

ProductAffected versionsFixed in
cisco rv016_firmwareNo range specified—
cisco rv042_firmwareNo range specified—
cisco rv042g_firmwareNo range specified—
cisco rv082_firmwareNo range specified—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.