Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability

A remote attacker, with a low-privilege account, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. Federal agencies are required to remediate by 2022-06-22 under CISA BOD 22-01.

This is a Deserialization of Untrusted Data (CWE-502) vulnerability in Cisco RV Series Routers. A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web-based management interface of the targeted device. A successful exploit could allow the attacker to execute commands with root privileges. Exploitation requires remote network access, low attack complexity, a low-privilege authenticated account, and no user interaction required.

Probably yes if any of these apply:

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2022-06-08 based on evidence of active exploitation in the wild. Federal agencies required to remediate by 2022-06-22.