CVE-2021-1472: Cisco Small Business RV Series Routers Vulnerabilities

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 72.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-04-08 · updated 2026-06-17
Weakness: CWE-119

Description

Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary commands or bypass authentication and upload files on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

Affected products

Cisco Rv160 Firmware: before 1.0.01.03 — fixed in 1.0.01.03
Cisco Rv160W Firmware: before 1.0.01.03 — fixed in 1.0.01.03
Cisco Rv260 Firmware: before 1.0.01.03 — fixed in 1.0.01.03
Cisco Rv260P Firmware: before 1.0.01.03 — fixed in 1.0.01.03
Cisco Rv260W Firmware: before 1.0.01.03 — fixed in 1.0.01.03
Cisco Rv340 Firmware: before 1.0.03.21 — fixed in 1.0.03.21
Cisco Rv340W Firmware: before 1.0.03.21 — fixed in 1.0.03.21
Cisco Rv345 Firmware: before 1.0.03.21 — fixed in 1.0.03.21
Cisco Rv345P Firmware: before 1.0.03.21 — fixed in 1.0.03.21

How to fix

Upgrade to a fixed version: Cisco Rv160 Firmware 1.0.01.03; Cisco Rv160W Firmware 1.0.01.03; Cisco Rv260 Firmware 1.0.01.03; Cisco Rv260P Firmware 1.0.01.03; Cisco Rv260W Firmware 1.0.01.03; Cisco Rv340 Firmware 1.0.03.21; Cisco Rv340W Firmware 1.0.03.21; Cisco Rv345 Firmware 1.0.03.21; Cisco Rv345P Firmware 1.0.03.21. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-1472 or the next vulnerability affects your stack