CVE-2020-3357 Other in Cisco Small Business RV Series Router Firmware

Critical 9.8 Published 16 Jul 2020 Updated 15 Nov 2024

Unauthenticated remote attackers can execute arbitrary code or cause denial of service on Cisco RV Series routers via crafted SSL requests.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-3357?

CVE-2020-3357 is a critical vulnerability in Cisco Small Business RV Series Router Firmware, published on 16 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the Secure Sockets Layer (SSL) VPN feature of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device or cause the device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because HTTP requests are not properly validated. An attacker could exploit this vulnerability by sending a crafted HTTP request over an SSL connection to an affected device. A successful exploit could allow the attacker to remotely execute arbitrary code on the device or cause the device to reload, resulting in a DoS condition.

Weakness: CWE-20

Which versions are affected by CVE-2020-3357?

It affects 4 products.

Products include Cisco Rv340 Dual Wan Gigabit Vpn Router Firmware, Cisco Rv340w Dual Wan Gigabit Wireless-Ac Vpn Router Firmware, Cisco Rv345 Dual Wan Gigabit Vpn Router Firmware, Cisco Rv345p Dual Wan Gigabit Poe Vpn Router Firmware.

How do I fix CVE-2020-3357?

No fix has been published for CVE-2020-3357 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-3357 being exploited?

There is no known exploitation of CVE-2020-3357 in the wild and no public exploit code.

Sources

Also known as GHSA-x7v4-2v57-r86h.