Riskcovery

CVE-2024-20362

State
Published
Severity
6.1 Medium
Published
Apr 3, 2024
Updated
Nov 7, 2024
Reserved
Nov 8, 2023

Read the record on cve.org

Description

A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by persuading a user to visit specific web pages that include malicious payloads. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Scores

CVSSScoreVectorSource
3.16.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Ncisco

Weaknesses

  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Affected Products

ProductVersions
Cisco Small Business RV Series Router FirmwareCisco
  • 1.1.0.09Affected
  • 1.1.1.19Affected
  • 1.1.1.06Affected
  • 1.2.1.14Affected
  • 2.0.0.19-tmAffected
  • 1.3.1.12Affected
  • 1.3.1.10Affected
  • 1.3.12.6-tmAffected
  • 1.3.13.02-tmAffected
  • 4.0.0.7Affected
  • 4.0.2.08-tmAffected
  • 4.0.3.03-tmAffected
  • 4.0.4.02-tmAffected
  • 4.2.2.08Affected
  • 4.2.3.03Affected
  • 4.2.3.06Affected
  • 4.2.3.07Affected
  • 4.2.3.09Affected
  • 4.2.3.10Affected
  • 4.2.3.14Affected
  • 1.4.2.15Affected
  • 1.4.2.17Affected
  • 1.4.2.19Affected
  • 1.4.2.22Affected
  • 3.0.0.1-tmAffected
  • and 2 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.