CVE-2021-34730 is a critical vulnerability in the Universal Plug-and-Play (UPnP) service of several Cisco Small Business RV series routers (RV110W, RV130, RV130W, RV215W). This flaw, stemming from improper validation of UPnP traffic, allows an unauthenticated, remote attacker to execute arbitrary code as root or cause a denial of service. With a CVSS score of 9.8 (Critical), exploitation requires no user interaction and has a high impact on confidentiality, integrity, and availability. Cisco has stated they will not release patches for these end-of-life products, despite significant community discussion and media coverage highlighting the risk. While no public exploit code or active exploitation has been confirmed, the high EPSS and FAUCET risk scores indicate a significant potential for future exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.0.3.55CPE matchmatch criteria | cpe:2.3:a:cisco:application_extension_platform:1.0.3.55:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:cisco:rv110w_wireless-n_vpn_firewall_firmware:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:cisco:rv130_vpn_router_firmware:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:cisco:rv130w_wireless-n_multifunction_vpn_router_firmware:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:cisco:rv215w_wireless-n_vpn_router_firmware:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.