CVE-2021-1472: Cisco Small Business RV Series Routers: auth bypass and command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, public exploit code, and very high EPSS make this an urgent edge-device risk.

What it is

The web-based management interface of Cisco Small Business RV Series Routers contains a memory buffer overflow (CWE-119) and an improper authentication flaw (CWE-287). A remote, unauthenticated attacker can bypass authentication, upload files, and execute arbitrary commands on the device. Because these routers sit at the network edge, compromise gives an attacker a foothold on perimeter infrastructure.

Impact

An attacker gains the ability to bypass authentication and run arbitrary commands with the privileges of the web management interface, effectively taking control of the router. This can enable traffic interception, redirection, or use of the device as a pivot into the internal network.

Attack surface

The flaws are reached over the network through the router's web-based management interface, per the CVSS vector AV:N/AC:L/PR:N/UI:N, meaning no authentication and no user interaction are required. Any internet- or network-exposed management interface is a candidate target.

Exploitation

The record is not listed in CISA KEV, but EPSS is very high (0.71834, 99.4th percentile) and public references are tagged Exploit, indicating working exploit code is publicly available. No ransomware association is documented.

What to do

• Apply the Cisco vendor advisory fixes for the affected RV160, RV260, RV340 and RV345 firmware as the first action.
• Disable or restrict remote management on the WAN interface and limit web UI access to trusted management networks.
• Place management interfaces behind a VPN or firewall allowlist rather than exposing them directly.
• Monitor Cisco advisories for updated firmware and verify the installed version after patching.
• If patching is not immediately possible, isolate affected routers on a segmented network and block inbound access to the management port.

Detection

• Review web server and router logs for unauthenticated requests to management endpoints, especially file upload or command-related paths.
• Alert on unexpected configuration changes, new admin accounts, or firmware/file uploads on RV Series devices.
• Monitor for outbound connections or traffic redirection originating from the router itself.
• Use network monitoring to detect scanning or exploit attempts against the router's web management interface.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.