CVE-2023-20073

Summary

CVE	CVE-2023-20073
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2023-04-05 16:15:00 UTC
Updated	2023-11-07 04:05:00 UTC
Description	A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to insufficient authorization enforcement mechanisms in the context of file uploads. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to upload arbitrary files to the affected device.

Risk And Classification

Problem Types: CWE-434

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Hardware	Cisco	Rv340	-	All	All	All
Hardware	Cisco	Rv340w	-	All	All	All
Operating System	Cisco	Rv340w Firmware	All	All	All	All
Operating System	Cisco	Rv340 Firmware	All	All	All	All
Hardware	Cisco	Rv345	-	All	All	All
Hardware	Cisco	Rv345p	-	All	All	All
Operating System	Cisco	Rv345p Firmware	All	All	All	All
Operating System	Cisco	Rv345 Firmware	All	All	All	All

References

Reference	Source	Link	Tags
Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Arbitrary File Upload Vulnerability	CISCO	sec.cloudapps.cisco.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

730691 Cisco Small Business RV (340|345) Series Routers Multiple Vulnerabilities (cisco-sa-sb-rv-rcedos-7HjP74jD,cisco-sa-sb-rv-afu-EXxwA65V)