Cisco Fixed RCE and Command Injection Flaws in VPN Router Series

Cisco released fixes for several vulnerabilities in its VPN routers. Affected products could be subject to remote code execution, command injection, and DoS attacks by unauthenticated, remote attackers. The vulnerabilities are labeled CVE-2022-20827, CVE-2022-20841, and CVE-2022-20842; and are caused by insufficient input validation. Currently, there is no evidence of exploitation in the wild.

How Do Vulnerabilities Affect?

CVE-2022-20842 exists in the web-based management interface of VPN routers. By sending a crafted HTTP input to a vulnerable device, an attacker can exploit it and perform RCE as a root user in the OS or cause denial-of-service.

CVE-2022-20827 can be exploited by sending crafted input to the web filter database update feature. This vulnerability could enable an attacker to execute arbitrary commands with root privilege, like in CVE-2022-20842.

CVE-2022-20841 is a vulnerability in the Cisco router’s PnP (Open Plug and Play) module. It can be exploited by a malicious input sent to the vulnerable device. To exploit it, the attacker must be in a MiTM (man-in-the-middle) position or already have control over a particular network device linked to the vulnerable router. According to Cisco, this vulnerability “could allow an unauthenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system.”