Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Command Injection Vulnerabilities

Vulnerability

The vulnerability exists in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers. It is caused by improper validation of user-supplied input, allowing an authenticated remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerable software versions are those running the affected firmware on the listed routers. No specific firmware version numbers are provided, but all versions prior to any eventual fix are assumed affected. The web-based management interface is accessible via LAN or WAN (if remote management is enabled) [1].

Exploitation

To exploit this vulnerability, an attacker must have valid administrator credentials for the affected device. The attacker sends crafted HTTP requests to the web-based management interface. The interface fails to properly sanitize input, leading to command injection. Successful exploitation requires network access to the device, either from the local LAN or over the WAN if remote management is enabled [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the underlying operating system with root privileges. This can lead to full compromise of the device, including data disclosure, modification, and denial of service. The attacker gains complete control over the router [1].

Mitigation

As of the advisory publication date (January 13, 2021), Cisco has not released software updates to address these vulnerabilities, and there are no available workarounds. Users are advised to monitor the advisory for updates and consider disabling remote management if not required to reduce the attack surface [1].