Vulnerabilities in Cisco VPN routers allow attackers to execute remote code

Cisco recently disclosed a significant flaw in the bootloader module of its RV340 and RV345 Dual WAN Gigabit VPN routers. This flaw could allow a remote, authenticated attacker to execute arbitrary code on an affected device.
This high-level vulnerability identified as CVE-2024-20416 (https://nvd.nist.gov/vuln/detail/CVE-2024-20416) is caused by insufficient checks in the processing of specified HTTP requests.
“An attacker could exploit this vulnerability by sending HTTP requests to an affected device,” Cisco said.
If the exploit is successful, an attacker can run arbitrary code as the “root” user on the device’s host operating system.
🔴 The following Cisco products are affected by this vulnerability:
“RV340 Dual WAN Gigabit VPN Routers”
“RV340W Dual WAN Gigabit Wireless-AC VPN Routers”
“RV345 Dual WAN Gigabit VPN Routers”
“RV345P Dual WAN Gigabit PoE VPN Routers”
🟢 Cisco has confirmed that the following products are not affected by this vulnerability:
“RV160 VPN Routers”
“RV160W Wireless-AC VPN Routers”
“RV260 VPN Routers”
“RV260P VPN Routers with PoE”
“RV260W Wireless-AC VPN Routers”
✅ UZCERT service allows Cisco customers to implement security updates released by Cisco (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv34x-rce-7pqFU2e) and Cisco security advisories recommends that they review the page. (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv34x-rce-7pqFU2e)