Cisco Small Business Routers RV016, RV042, RV042G, and RV082 Information Disclosure Vulnerability

Vulnerability

The vulnerability resides in the web-based management interface of Cisco Small Business RV Series Routers. It is caused by improper authorization of HTTP requests. Affected models include RV016, RV042, RV042G, and RV082 running firmware versions prior to 4.2.3.10. The RV016 and RV082 have reached end of software maintenance. [1]

Exploitation

An unauthenticated, remote attacker can exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected device. No authentication or prior access is required. The attacker only needs network connectivity to the device.

Impact

Successful exploitation allows the attacker to view information displayed in the web-based management interface without authentication. This results in information disclosure, potentially exposing sensitive configuration or network details. No code execution or data modification is possible.

Mitigation

Cisco has released firmware version 4.2.3.10 to address the vulnerability. There are no available workarounds. Users should upgrade to the fixed release. Note that the RV016 and RV082 routers are end-of-life and may not receive updates; replacement is recommended. [1]