CVE-2024-20393

Q: What is the severity of CVE-2024-20393?

CVE-2024-20393 has a CVSS score of 8.8 (HIGH). This vulnerability in Cisco Small Business VPN routers allows authenticated remote attackers to escalate privileges from guest to admin by exploiting information disclosure in the web management interface. It affects RV340, RV340W, RV345, and RV345P routers with web management enabled. Attackers can gain full administrative control over affected devices.

8.8 HIGH

📋 TL;DR

This vulnerability in Cisco Small Business VPN routers allows authenticated remote attackers to escalate privileges from guest to admin by exploiting information disclosure in the web management interface. It affects RV340, RV340W, RV345, and RV345P routers with web management enabled. Attackers can gain full administrative control over affected devices.

💻 Affected Systems

Products:

Cisco RV340
Cisco RV340W
Cisco RV345
Cisco RV345P

Versions: All versions prior to the fixed release

Operating Systems: Cisco IOS-based firmware

Default Config Vulnerable: ⚠️ Yes

Notes: Requires web-based management interface to be enabled and accessible. Guest accounts must exist for privilege escalation to occur.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full administrative takeover of the router, enabling traffic interception, network reconfiguration, credential harvesting, and potential lateral movement into connected networks.

🟠

Likely Case

Privilege escalation from guest to admin, allowing attackers to modify router settings, create VPN tunnels, disable security features, and potentially install persistent backdoors.

🟢

If Mitigated

Limited impact if guest accounts are disabled, web management is restricted to internal networks only, and strong authentication is enforced.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access (guest account) and involves sending crafted HTTP requests to the web interface.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check Cisco advisory for specific fixed versions per model

Vendor Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv34x-privesc-rce-qE33TCms

Restart Required: Yes

Instructions:

1. Log into router web interface as admin. 2. Navigate to Administration > Firmware Upgrade. 3. Download latest firmware from Cisco support site. 4. Upload and install firmware. 5. Reboot router after installation completes.

🔧 Temporary Workarounds

Disable Guest Accounts

all

Remove or disable all guest accounts to prevent authenticated access required for exploitation

Navigate to Administration > User Accounts in web interface and disable/delete guest accounts

Restrict Web Management Access

all

Limit web interface access to trusted internal IP addresses only

Configure firewall rules to restrict access to router management IP/port from specific source IPs

🧯 If You Can't Patch

Disable all guest accounts and use only admin accounts with strong passwords
Restrict web management interface to internal network only using firewall rules

🔍 How to Verify

Check if Vulnerable:

Check firmware version in web interface under Administration > Firmware Upgrade and compare with Cisco advisory

Check Version:

Log into web interface and navigate to Administration > Firmware Upgrade to view current version

Verify Fix Applied:

Verify firmware version matches or exceeds fixed version listed in Cisco advisory

📡 Detection & Monitoring

Log Indicators:

Multiple failed authentication attempts followed by successful guest login
Unusual privilege escalation events in system logs
Configuration changes from non-admin accounts

Network Indicators:

HTTP requests to management interface with crafted parameters
Traffic patterns suggesting privilege escalation attempts

SIEM Query:

source="router_logs" AND (event_type="authentication" AND user="guest" AND result="success") OR (event_type="privilege_change" AND from_level="guest" AND to_level="admin")

📊 Metadata

CVE ID: CVE-2024-20393

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-285

Published: October 2, 2024

Last Updated: October 8, 2024

🔗 References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv34x-privesc-rce-qE33TCms Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Rv340 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv340 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv340 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv340 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv340 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv340 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv340 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv340 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv340 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv340 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv340 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv340 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv340 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv340 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv340 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv340 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv340 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv340 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv340 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv340 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv340w Dual Wan Gigabit Wireless Ac Vpn Router Firmware by Cisco

Rv340w Dual Wan Gigabit Wireless Ac Vpn Router Firmware by Cisco

Rv340w Dual Wan Gigabit Wireless Ac Vpn Router Firmware by Cisco

Rv340w Dual Wan Gigabit Wireless Ac Vpn Router Firmware by Cisco

Rv340w Dual Wan Gigabit Wireless Ac Vpn Router Firmware by Cisco

Rv340w Dual Wan Gigabit Wireless Ac Vpn Router Firmware by Cisco

Rv340w Dual Wan Gigabit Wireless Ac Vpn Router Firmware by Cisco

Rv340w Dual Wan Gigabit Wireless Ac Vpn Router Firmware by Cisco

Rv340w Dual Wan Gigabit Wireless Ac Vpn Router Firmware by Cisco

Rv340w Dual Wan Gigabit Wireless Ac Vpn Router Firmware by Cisco

Rv340w Dual Wan Gigabit Wireless Ac Vpn Router Firmware by Cisco

Rv340w Dual Wan Gigabit Wireless Ac Vpn Router Firmware by Cisco

Rv340w Dual Wan Gigabit Wireless Ac Vpn Router Firmware by Cisco

Rv340w Dual Wan Gigabit Wireless Ac Vpn Router Firmware by Cisco

Rv340w Dual Wan Gigabit Wireless Ac Vpn Router Firmware by Cisco

Rv340w Dual Wan Gigabit Wireless Ac Vpn Router Firmware by Cisco

Rv340w Dual Wan Gigabit Wireless Ac Vpn Router Firmware by Cisco

Rv340w Dual Wan Gigabit Wireless Ac Vpn Router Firmware by Cisco

Rv340w Dual Wan Gigabit Wireless Ac Vpn Router Firmware by Cisco

Rv340w Dual Wan Gigabit Wireless Ac Vpn Router Firmware by Cisco

Rv345 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv345 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv345 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv345 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv345 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv345 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv345 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv345 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv345 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv345 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv345 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv345 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv345 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv345 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv345 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv345 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv345 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv345 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv345 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv345 Dual Wan Gigabit Vpn Router Firmware by Cisco

Rv345p Dual Wan Gigabit Poe Vpn Router Firmware by Cisco

Rv345p Dual Wan Gigabit Poe Vpn Router Firmware by Cisco

Rv345p Dual Wan Gigabit Poe Vpn Router Firmware by Cisco

Rv345p Dual Wan Gigabit Poe Vpn Router Firmware by Cisco

Rv345p Dual Wan Gigabit Poe Vpn Router Firmware by Cisco

Rv345p Dual Wan Gigabit Poe Vpn Router Firmware by Cisco

Rv345p Dual Wan Gigabit Poe Vpn Router Firmware by Cisco

Rv345p Dual Wan Gigabit Poe Vpn Router Firmware by Cisco

Rv345p Dual Wan Gigabit Poe Vpn Router Firmware by Cisco

Rv345p Dual Wan Gigabit Poe Vpn Router Firmware by Cisco

Rv345p Dual Wan Gigabit Poe Vpn Router Firmware by Cisco

Rv345p Dual Wan Gigabit Poe Vpn Router Firmware by Cisco

Rv345p Dual Wan Gigabit Poe Vpn Router Firmware by Cisco

Rv345p Dual Wan Gigabit Poe Vpn Router Firmware by Cisco

Rv345p Dual Wan Gigabit Poe Vpn Router Firmware by Cisco

Rv345p Dual Wan Gigabit Poe Vpn Router Firmware by Cisco

Rv345p Dual Wan Gigabit Poe Vpn Router Firmware by Cisco