Cisco Small Business RV110W, RV130, RV130W, and RV215W Series Routers Command Shell Injection Vulnerability

Vulnerability

The vulnerability is a command injection in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Series Routers. It stems from insufficient input validation of user-supplied data. An authenticated remote attacker can send a crafted request to inject arbitrary shell commands. Affected versions are those running firmware prior to the fixed releases mentioned in the Cisco advisory [1].

Exploitation

An attacker must have valid credentials to the web-based management interface. They then send a specially crafted HTTP request containing malicious shell commands. The device processes the request and executes the commands with root privileges. No additional user interaction is required beyond authentication.

Impact

Successful exploitation allows the attacker to execute arbitrary shell commands or scripts with root privileges on the affected device. This leads to full compromise of the router, including potential data exfiltration, further network attacks, or denial of service.

Mitigation

Cisco has released free software updates to address this vulnerability. Customers are advised to upgrade to the fixed firmware versions as specified in the Cisco Security Advisory [1]. No workarounds are mentioned; upgrading is the recommended mitigation. The advisory does not list the specific fixed version numbers, but customers should consult the advisory for details.