Security News > 2021 > April > Cisco Will Not Patch Critical RCE Flaw Affecting End-of-Life Business Routers

Networking equipment major Cisco Systems has said it does not plan to fix a critical security vulnerability affecting some of its Small Business routers, instead urging users to replace the devices.

The bug, tracked as CVE-2021-1459, is rated with a CVSS score of 9.8 out of 10, and affects RV110W VPN firewall and Small Business RV130, RV130W, and RV215W routers, allowing an unauthenticated, remote attacker to execute arbitrary code on an affected appliance.

"A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system of the affected device," Cisco said in its advisory.

"The Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers have entered the end-of-life process," the firm said.

"Customers are encouraged to migrate to the Cisco Small Business RV132W, RV160, or RV160W Routers."

Separately, Cisco has also released software updates to address multiple vulnerabilities in Cisco SD-WAN vManage Software that could permit an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated, local attacker to gain escalated privileges on an affected system.

News URL

http://feedproxy.google.com/~r/TheHackersNews/~3/XoACclVN3nU/cisco-will-not-patch-critical-rce-flaw.html