Security researchers at CyCognito have discovered a significant cross-site scripting (XSS) vulnerability in the web admin interface of two small business routers from Cisco.
The XSS vulnerability exists in the company’s RVO42 and RV042G routers and it provides attackers with an easy way to take control of the devices’ web configuration utility.
This could allow an attacker to perform a number of admin actions from viewing and modifying sensitive information to taking control of the router or even having the ability to move laterally and gain access to other systems on the network.
Admin configuration utility
CyCognito’s platform was actually responsible for discovering the XSS vulnerability in Cisco’s RVO42 and RV042G routers which the company’s research team and then Cisco verified.
The platform detected the vulnerability when mapping the attack surface of a customer that was using one of the affected Cisco small business routers. It was at this point that the research team quickly realized that it had found a previously unreported vulnerability or zero-day.
In a press release, head of security research at CyCognito, Alex Zaslavsky provided further insight on the firm’s findings, saying:
“Commandeering a network router puts attackers in a prime position for intercepting company secrets and crucial data and to advance their attacks. Attackers value XSS vulnerabilities because they can be used to access a victim’s current session and even take over an account and impersonate the victim. A vulnerability in an admin configuration utility can be even more damaging as phished credentials can be used to try to gain access to other systems within a company’s infrastructure. That’s why we worked with Cisco to help resolve this vulnerability to ensure organizations remain secure.”
According to a recent security advisory, Cisco has now released software updates that address the XSS vulnerability in both routers.