CVE-2021-1308
📋 TL;DR
This vulnerability allows an unauthenticated attacker on the same network segment to execute arbitrary code, leak memory, or cause denial of service on affected Cisco Small Business RV Series Routers. Attackers must be Layer 2 adjacent to the target device. Organizations using these routers in vulnerable configurations are affected.
💻 Affected Systems
- Cisco Small Business RV Series Routers
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, persistent backdoor installation, and lateral movement within the network.
Likely Case
Denial of service through memory leaks or device reloads, disrupting network connectivity for connected users and services.
If Mitigated
Limited to denial of service if code execution fails, but still causes network disruption until device restart.
🎯 Exploit Status
Requires Layer 2 adjacency and crafting of malicious LLDP packets. No authentication needed, but attacker must be on same network segment.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Cisco advisory for specific fixed versions per device model
Vendor Advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-multi-lldp-u7e4chCe
Restart Required: Yes
Instructions:
1. Identify your RV Series router model. 2. Check Cisco advisory for fixed firmware version. 3. Download firmware from Cisco support site. 4. Upload and install via web interface. 5. Reboot router after installation.
🔧 Temporary Workarounds
Disable LLDP
allDisable Link Layer Discovery Protocol on affected interfaces to prevent exploitation
configure terminal
interface [interface-name]
no lldp transmit
no lldp receive
end
write memory
Network Segmentation
allIsolate RV Series routers on separate VLANs to limit Layer 2 adjacency
🧯 If You Can't Patch
- Implement strict network segmentation to limit devices that can communicate with RV routers
- Deploy network monitoring for anomalous LLDP traffic and implement ACLs to restrict LLDP communications
🔍 How to Verify
Check if Vulnerable:
Check router firmware version against affected versions in Cisco advisory. Also verify LLDP status with 'show lldp neighbors' or web interface.Check Version:
show version (CLI) or check System Information in web interfaceVerify Fix Applied:
Confirm firmware version matches patched version from Cisco advisory. Verify LLDP functionality if re-enabled after patch.📡 Detection & Monitoring
Log Indicators:
- Unexpected device reboots
- Memory allocation errors in system logs
- LLDP protocol anomalies
Network Indicators:
- Unusual LLDP traffic patterns
- LLDP packets with malformed TLVs
- Traffic from unexpected MAC addresses to router management interfaces
SIEM Query:
source="router_logs" AND ("reboot" OR "memory" OR "lldp") AND severity=ERROR