Severity
High
Analysis Summary
CVE-2021-34730
A vulnerability in the Universal Plug-and-Play (UPnP) service of Cisco Small Business Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly, resulting in a denial of service (DoS) condition.This vulnerability is due to improper validation of incoming UPnP traffic. An attacker could exploit this vulnerability by sending a crafted UPnP request to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a DoS condition.
Impact
- Code Execution
- Denial of Service
- Unauthorized Access
Affected Vendors
Cisco
Affected Products
- Cisco Small Business RV Series Routers RV110W Wireless-N VPN Firewalls
- Cisco Small Business RV Series Routers RV130 VPN Routers
- RV130W Wireless-N Multifunction VPN Routers
- Cisco Small Business RV Series Routers RV215W Wireless-N VPN Routers
Remediation
Refer to Cisco Security Advisory for the patch, upgrade, or suggested workaround information.