Auth bypass in Cisco Small Business Rv Series Router Firmware
CVE-2024-20393
A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to elevate privileges on an affected device. This…
EPSS: 0.006 (44.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Cisco Small Business Rv Series Router Firmware — versions 1.0.01.17, 1.0.03.17, 1.0.01.16
- Cisco Rv340_dual_wan_gigabit_vpn_router
- Cisco Rv340_dual_wan_gigabit_vpn_router_firmware — versions 1.0.00.29, 1.0.00.33, 1.0.01.16
- Cisco Rv340w_dual_wan_gigabit_wireless-ac_vpn_router
- Cisco Rv340w_dual_wan_gigabit_wireless-ac_vpn_router_firmware — versions 1.0.00.29, 1.0.00.33, 1.0.01.16
- Cisco Rv345_dual_wan_gigabit_vpn_router
- Cisco Rv345_dual_wan_gigabit_vpn_router_firmware — versions 1.0.00.29, 1.0.00.33, 1.0.01.16
- Cisco Rv345p_dual_wan_gigabit_poe_vpn_router
- Cisco Rv345p_dual_wan_gigabit_poe_vpn_router_firmware — versions 1.0.00.29, 1.0.00.33, 1.0.01.16
Weakness classification (CWE)
References
- psirt@cisco.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2024-20393?
- CVE-2024-20393 is a high-severity vulnerability in Cisco Small Business Rv Series Router Firmware, classified under Improper Authorization. CVSS score: 8.8/10. Published 2024-10-02.
- How severe is CVE-2024-20393?
- High severity. CVSS v3 base score is 8.8 out of 10.