CVE-2021-40120

A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker with administrative privileges to inject arbitrary commands into the underlying operating system and execute them using root-level privileges. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious input to a specific field in the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system as a user with root-level privileges.

• CWE-20
• CWE-78

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sbrv-cmdinjection-Z5cWFdKVendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sbrv-cmdinjection-Z5cWFdKVendor Advisory

Published

Nov 4, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-40114Multiple Cisco products are affected by a vulnerability in t…7.5
• CVE-2021-40115A vulnerability in Cisco Webex Video Mesh could allow an una…6.1
• CVE-2021-40116Multiple Cisco products are affected by a vulnerability in S…7.5
• CVE-2021-40117A vulnerability in SSL/TLS message handler for Cisco Adaptiv…7.5
• CVE-2021-40118A vulnerability in the web services interface of Cisco Adapt…7.5
• CVE-2021-40119A vulnerability in the key-based SSH authentication mechanis…9.8
• CVE-2021-40121Multiple vulnerabilities in the web-based management interfa…4.8
• CVE-2021-40122A vulnerability in an API of the Call Bridge feature of Cisc…7.5
• CVE-2021-40123A vulnerability in the web-based management interface of Cis…6.5
• CVE-2021-40124A vulnerability in the Network Access Manager (NAM) module o…7.8
• CVE-2021-40125A vulnerability in the Internet Key Exchange Version 2 (IKEv…6.5
• CVE-2021-40126A vulnerability in the web-based dashboard of Cisco Umbrella…4.3