{"uuid": "e1664b6f-31de-4db5-96ed-c1fcfc286d17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1609", "type": "seen", "source": "https://t.me/hacking_Attack/19541", "content": "Black Hat Ethical Hacking\nCritical Cisco Bug in VPN Routers Allows Remote Takeover\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Critical Cisco Bug in VPN Routers Allows Remote TakeoverPost Views: 82 \nReading Time: 1 Minute\nA critical security vulnerability in a subset of Cisco Systems\u2019 small-business VPN routers could allow a remote, unauthenticated attacker to take over a device, and researchers said there are at least 8,800 vulnerable systems open to compromise.\nCisco addressed the bugs (CVE-2021-1609) as part of a slew of patches rolled out this week. In total, the fixes and affected products are as follows:\n\n* Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Web Management Vulnerabilities (advisory)\n* Cisco Small Business RV160 and RV260 Series VPN Routers Remote Command Execution Vulnerability (advisory)\n* Cisco Packet Tracer for Windows DLL Injection Vulnerability (advisory)\n* Cisco Network Services Orchestrator CLI Secure Shell Server Privilege Escalation Vulnerability (advisory)\n* ConfD CLI Secure Shell Server Privilege Escalation Vulnerability (advisory)\nSee Also: Black Hat: \u2018I\u2019m Calling About Your Car Warranty\u2019, aka PII Hijinx Critical RCE Security Bug in Gigabit VPN RoutersThe critical bug affects the vendor\u2019s Dual WAN Gigabit VPN routers. According to the advisory, CVE-2021-1609 exists in the web management interface for the devices, and carries a CVSSv3 vulnerability-severity score of 9.8. It arises due to improper validation of HTTP requests.\n\nAccording to a Thursday analysis\u00a0from Tenable, a remote, unauthenticated attacker could thus exploit the vulnerability by sending a specially crafted HTTP request to a vulnerable device, \u201cresulting in arbitrary code-execution as well as the ability to reload the device, resulting in a denial of service (DoS).\u201d\n\nRemote management of these devices is disabled by default according to Cisco, which would thwart such attacks. However, researchers at Tenable found that more than 8,800 devices are publicly accessible and vulnerable to exploit.\n\nMeanwhile, a second bug affecting the same devices, CVE-2021-1610, is a high-rated command-injection vulnerability in the same web management interface.\n\n\u201cWhile both flaws exist due to improper validation of HTTP requests and can be exploited by sending specially crafted HTTP requests, CVE-2021-1610 can only be exploited by an authenticated attacker with root privileges,\u201d according to Tenable. \u201cSuccessful exploitation would grant an attacker the ability to gain arbitrary command execution on the vulnerable device\u2019s operating system.\u201d\n\nThe web management interface for its small business VPN routers is available by default through local area network connections and can\u2019t be disabled, Cisco noted, adding that that some versions of the router software may only be affected by one of the two vulnerabilities.\nSee Also: Offensive Security Tool: Mimikatz Though no in-the-wild exploitation has been seen thus far for the bugs, Tenable warned that this is likely to change.\n\n\u201cIn January 2019, Cisco published advisories for two different vulnerabilities in its RV320 and RV325 WAN VPN routers,\u201d according to the analysis. \u201cA few days after the advisories were published, proof-of-concept exploit scripts for these flaws were published, which was followed by active scanning for vulnerable devices. Because of this historical precedent, we believe it is important that organizations patch these latest vulnerabilities as soon as possible.\u201d\n\nIf patching isn\u2019t possible, users should make sure that remote web management is disabled, the firm added. High-Severity Cisco Security BugsCisco also addressed severa[...]", "creation_timestamp": "2026-09-01T20:02:29.831116Z"}