Cisco Small Business RV Series Routers Stack Overflow Arbitrary Code Execution Vulnerabilities

Vulnerability

The vulnerability (CVE-2020-3286) exists in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers, as well as RV016, RV042, and RV082 Routers. It is due to insufficient boundary restrictions on user-supplied input to scripts in the web-based management interface. An authenticated remote attacker with administrative privileges can trigger a stack overflow by sending crafted requests with overly large values. Affected firmware versions are those prior to the fixed releases described in the Cisco advisory [1].

Exploitation

An attacker must have administrative credentials sufficient to log into the web-based management interface. The attacker then sends specially crafted HTTP requests containing overly large input values to the vulnerable device, causing a stack overflow. No user interaction beyond the initial authentication is required, and the attack is performed remotely over the network [1].

Impact

Successful exploitation can cause the device to crash or allow the attacker to execute arbitrary code with root privileges on the underlying operating system. This gives full control over the router, potentially leading to data exfiltration, network disruption, or further lateral movement [1].

Mitigation

Cisco has released free software updates to address these vulnerabilities. Customers should upgrade to fixed firmware versions as specified in the Cisco Security Advisory [1]. As of the advisory publication date (June 17, 2020), no workaround was available. The vulnerabilities are not known to be listed on the CISA KEV as of the publication date [1].