Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Command Injection Vulnerabilities

Vulnerability

The vulnerabilities (CVE-2021-1148) affect the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers [1]. The issue is due to improper validation of user-supplied input in the management interface. An attacker with valid administrator credentials can inject arbitrary commands by sending crafted HTTP requests to the device [1]. The vulnerable interface is available over a local LAN connection by default, or over the WAN if remote management is enabled [1]. No software updates have been released to address these vulnerabilities [1].

Exploitation

To exploit, an attacker must have valid administrator credentials for an affected device [1]. The attacker then sends specially crafted HTTP requests to the web-based management interface, which are processed without proper input validation, leading to command injection [1]. The attack can be launched remotely if remote management is enabled, or from the local LAN [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands with root privileges on the underlying operating system [1]. This gives the attacker full control over the device, enabling them to modify configurations, access sensitive data, or pivot to other network resources [1].

Mitigation

Cisco has not released software updates to address these vulnerabilities and there are no workarounds [1]. Users should disable remote management if possible and restrict access to the management interface to trusted networks only [1]. The devices are not listed as End of Life, but no patch timeline has been provided [1].