Vulnerability Details : CVE-2021-1473

Products affected by CVE-2021-1473

Metasploit modules for CVE-2021-1473

• Cisco Small Business RV Series Authentication Bypass and Command Injection

  Disclosure Date: 2021-04-07

  First seen: 2022-12-23

  exploit/linux/http/cisco_rv_series_authbypass_and_rce

  This module exploits an authentication bypass (CVE-2021-1472) and command injection (CVE-2021-1473) in the Cisco Small Business RV series of VPN/routers. The device does not adequately verify the credentials in the HTTP Authorization field when requests are made to the

  More information

CVSS scores for CVE-2021-1473

CWE ids for CVE-2021-1473

• CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
  The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
  Assigned by: nvd@nist.gov (Primary)
• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
  The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
  Assigned by: ykramarz@cisco.com (Secondary)

References for CVE-2021-1473