CVE-2021-1152 Cross-site scripting in Cisco Small Business RV Series Router Firmware
Authenticated attackers can inject scripts into the router management interface, enabling code execution or data theft against other users.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-1152?
CVE-2021-1152 is a medium-severity cross-site scripting vulnerability in Cisco Application Extension Platform, published on 13 Jan 2021. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. The vulnerabilities are due to insufficient input validation by the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
Weakness: CWE-79
Which versions are affected by CVE-2021-1152?
It affects 5 products.
Products include Cisco Application Extension Platform, Cisco Rv110w Firmware, Cisco Rv130 Vpn Router Firmware, Cisco Rv130w Firmware, Cisco Rv215w Wireless-N Vpn Router Firmware.
How do I fix CVE-2021-1152?
No fix has been published for CVE-2021-1152 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-1152 being exploited?
There is no known exploitation of CVE-2021-1152 in the wild and no public exploit code.
Other vulnerabilities in Cisco Application Extension Platform
- CVE-2021-34730 Memory corruption in Cisco Small Business RV Series Router Firmware
- CVE-2021-1146 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Command Injection Vulnerabilities
- CVE-2021-1147 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Command Injection Vulnerabilities
- CVE-2021-1148 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Command Injection Vulnerabilities
- CVE-2021-1149 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Command Injection Vulnerabilities
Sources
Also known as GHSA-j385-7m59-57jx.