Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Command Injection Vulnerabilities

Vulnerability

The vulnerability resides in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers. Due to improper validation of user-supplied input, an authenticated remote attacker can inject arbitrary operating system commands that are executed with root privileges. Affected devices run firmware versions prior to any fix; Cisco has not released software updates addressing these flaws [1].

Exploitation

An attacker must possess valid administrator credentials for the target device. The attack is performed by sending specially crafted HTTP requests to the web-based management interface, which is accessible over the local LAN by default. If remote management is enabled (disabled by default), the interface is also reachable via the WAN connection. No additional user interaction is required beyond initial authentication [1].

Impact

Successful exploitation grants the attacker arbitrary command execution with root privileges on the underlying operating system. This leads to full compromise of the router, including the ability to modify configuration, intercept network traffic, and pivot to internal networks. The impact is critical (CVSS 9.1) due to the high privilege level and lack of required interaction beyond admin credentials [1].

Mitigation

Cisco has not released software updates that address these vulnerabilities as of the advisory publication date (January 13, 2021). No workarounds are available. The only mitigation is to restrict access to the web-based management interface to trusted administrators only, disable remote management if not required, and monitor for signs of compromise [1].