Read the docs
TI-2024-13295 Aliases CVE-2024-20362GHSA-cjq2-28pq-mq54

Cross-site scripting in Cisco Small Business RV Series Router Firmware

Priority LOW 28CWE-80Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-80.

Summary

A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by persuading a user to visit specific web pages that include malicious payloads. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00492 42nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Small Business RV Series Router Firmware1.1.0.09; 1.1.1.19; 1.1.1.06; 1.2.1.14; 2.0.0.19-tm; 1.3.1.12; 1.3.1.10; 1.3.12.6-tm; 1.3.13.02-tm; 4.0.0.7; 4.0.2.08-tm; 4.0.3.03-tm; 4.0.4.02-tm; 4.2.2.08; 4.2.3.03; 4.2.3.06; 4.2.3.07; 4.2.3.09; 4.2.3.10; 4.2.3.14; 1.4.2.15; 1.4.2.17; 1.4.2.19; 1.4.2.22; 3.0.0.1-tm; 4.1.1.01; 1.5.1.05—No fix listedCNA
  • Cisco Small Business RV Series Router Firmware VendorCisco Affected 1.1.0.09; 1.1.1.19; 1.1.1.06; 1.2.1.14; 2.0.0.19-tm; 1.3.1.12; 1.3.1.10; 1.3.12.6-tm; 1.3.13.02-tm; 4.0.0.7; 4.0.2.08-tm; 4.0.3.03-tm; 4.0.4.02-tm; 4.2.2.08; 4.2.3.03; 4.2.3.06; 4.2.3.07; 4.2.3.09; 4.2.3.10; 4.2.3.14; 1.4.2.15; 1.4.2.17; 1.4.2.19; 1.4.2.22; 3.0.0.1-tm; 4.1.1.01; 1.5.1.05 Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:o:cisco:rv016_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:h:cisco:rv016:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:rv042_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:h:cisco:rv042:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:rv042g_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:h:cisco:rv042g:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:rv082_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:h:cisco:rv082:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:rv320_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:h:cisco:rv320:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
  • cpe:2.3:o:cisco:rv016_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:h:cisco:rv016:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:rv042_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:h:cisco:rv042:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:rv042g_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:h:cisco:rv042g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:rv082_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:h:cisco:rv082:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:rv320_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:h:cisco:rv320:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:cisco:rv325_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
cpe:2.3:h:cisco:rv325:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
  • cpe:2.3:o:cisco:rv325_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
  • cpe:2.3:h:cisco:rv325:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-20362
  2. 2026-10-03 Alias added: GHSA-cjq2-28pq-mq54

References

Advisory 1

  • TI-2023-06825 Command injection in Cisco Small Business RV Series Router Firmware KEVCVSS 3.1HIGH 7.2
  • TI-2023-06734 Authentication bypass by spoofing in Cisco Small Business RV Series Router Firmware CVSS 3.1CRITICAL 9.8
  • TI-2020-02854 Cisco Small Business RV Series Routers Stack Overflow Arbitrary Code Execution Vulnerabilities CVSS 3.1HIGH 7.2
  • TI-2020-02853 Cisco Small Business RV Series Routers Stack Overflow Arbitrary Code Execution Vulnerabilities CVSS 3.1HIGH 7.2
  • TI-2020-02852 Cisco Small Business RV Series Routers Stack Overflow Arbitrary Code Execution Vulnerabilities CVSS 3.1HIGH 7.2
  • TI-2020-02851 Cisco Small Business RV Series Routers Stack Overflow Arbitrary Code Execution Vulnerabilities CVSS 3.1HIGH 7.2
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences