CVE-2024-20393: Cisco RV340 Privilege Escalation Flaw

CVE-2024-20393 Overview

CVE-2024-20393 is a privilege escalation vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers. The flaw stems from sensitive information disclosure in the management interface. An authenticated remote attacker with guest-level credentials can send crafted HTTP input to elevate their privileges to administrator on the affected device. The vulnerability is classified under CWE-285: Improper Authorization and impacts confidentiality, integrity, and availability once exploited.

Critical Impact
A low-privileged guest account can be escalated to full admin, granting complete control over the VPN router, its routing tables, VPN configurations, and traffic flowing through it.

Affected Products

Cisco RV340 and RV340W Dual WAN Gigabit VPN Routers (firmware 1.0.00.29 through 1.0.03.29)
Cisco RV345 Dual WAN Gigabit VPN Router (firmware 1.0.00.29 through 1.0.03.29)
Cisco RV345P Dual WAN Gigabit PoE VPN Router (firmware 1.0.00.29 through 1.0.03.29)

Discovery Timeline

2024-10-02 - CVE-2024-20393 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20393

Vulnerability Analysis

The vulnerability resides in the web-based management interface exposed by the RV34x router family. The interface returns sensitive information to authenticated users regardless of their assigned role. A guest-tier account, which should be restricted to read-only status data, can extract material that enables administrative actions.

Once the attacker leverages the disclosed information, they gain full administrative control. This includes the ability to modify firewall rules, VPN tunnels, DHCP scopes, and firmware. The attack is network-reachable and requires only low-privileged credentials, which is significant for small-business appliances where guest accounts are common.

Root Cause

The root cause is improper authorization ([CWE-285]) in HTTP request handling within the management interface. Authorization checks fail to consistently restrict sensitive endpoints or response fields to administrator sessions. Instead, the interface discloses privileged data to any authenticated session, including guest sessions.

Attack Vector

An attacker first authenticates to the router's HTTPS management interface using guest credentials. The attacker then sends crafted HTTP requests to endpoints that leak sensitive information. Using this information, the attacker escalates the session to administrator, gaining full control of the device. No user interaction is required after credentials are obtained.

Because exploitation requires only authenticated access and crafted HTTP input, no exploit code is required beyond a standard HTTP client. Refer to the Cisco Security Advisory for vendor-provided technical details.

Detection Methods for CVE-2024-20393

Indicators of Compromise

Unexpected administrator-level configuration changes originating from accounts that were provisioned as guest users.
HTTPS requests from guest sessions to management endpoints that normally return administrator-only content.
New administrator accounts, altered VPN tunnels, or modified firewall rules with no corresponding change-management ticket.
Firmware versions in the range 1.0.00.29 through 1.0.03.29 still deployed on internet-exposed RV34x devices.

Detection Strategies

Enable and forward web management interface access logs to a central SIEM for correlation of user role versus accessed endpoint.
Alert on privilege changes and account creation events on RV340, RV340W, RV345, and RV345P devices.
Baseline normal guest-account HTTP traffic and flag deviations, particularly requests to configuration or backup endpoints.

Monitoring Recommendations

Restrict management-interface exposure to internal management networks and monitor any inbound WAN-side connection attempts.
Continuously inventory RV34x firmware versions and flag devices running vulnerable builds.
Audit local user accounts monthly and remove unused guest accounts.

How to Mitigate CVE-2024-20393

Immediate Actions Required

Upgrade RV340, RV340W, RV345, and RV345P firmware to the fixed release identified in the Cisco Security Advisory.
Disable remote (WAN-side) HTTPS management until the device is patched.
Rotate all local device credentials, including guest accounts, after patching.
Review recent configuration changes and administrator account additions for signs of prior exploitation.

Patch Information

Cisco has released fixed firmware for the RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers. See the Cisco Security Advisory cisco-sa-rv34x-privesc-rce-qE33TCms for the specific fixed versions and download instructions. No workarounds are officially provided by the vendor; patching is required.

Workarounds

Limit management interface access to a dedicated management VLAN with strict ACLs.
Remove or disable guest and other low-privileged local accounts that are not strictly required.
Enforce multi-factor authentication on any upstream VPN or jump host used to reach the management interface.

bash

# Configuration example: restrict management interface to trusted subnet
# Applied on an upstream firewall or the router's access-list configuration
access-list MGMT_ONLY permit tcp 10.10.0.0 0.0.0.255 host <router-ip> eq 443
access-list MGMT_ONLY deny   tcp any host <router-ip> eq 443
access-list MGMT_ONLY permit ip any any