Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerabilities reside in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers. Due to improper validation of user-supplied input, an authenticated attacker can send crafted HTTP requests to trigger a buffer overflow or other memory corruption. All versions of these routers are affected as no software updates have been released [1].

Exploitation

An attacker must have valid administrator credentials to access the web-based management interface. The interface is accessible via LAN, or over WAN if remote management is enabled (disabled by default). The attacker sends specially crafted HTTP requests to the device, exploiting the input validation flaw [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code with root privileges on the underlying operating system, or cause the device to reload, resulting in a denial of service (DoS) condition. Both outcomes represent a complete compromise of confidentiality, integrity, and availability [1].

Mitigation

Cisco has not released software updates to address these vulnerabilities. There are no workarounds. Administrators should disable remote management if not required and restrict access to the management interface to trusted networks. The devices are not listed in the CISA Known Exploited Vulnerabilities catalog [1].