Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerabilities reside in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers. They are due to improper validation of user-supplied input. An attacker must be authenticated with valid administrator credentials. The interface is accessible via LAN or WAN if remote management is enabled (disabled by default). These vulnerabilities are tracked as CVE-2021-1162 (among others) and affect all firmware versions as no patches exist [1].

Exploitation

An attacker with administrator credentials can send crafted HTTP requests to the affected device's web-based management interface. The attacker can be on the local network or remotely if remote management is enabled. No user interaction is required beyond the initial authentication. The crafted input triggers a buffer overflow or other input validation flaw, leading to code execution or device reload [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload unexpectedly, resulting in a denial of service condition. The attacker gains full control of the device or disrupts its operation [1].

Mitigation

Cisco has not released software updates that address these vulnerabilities as of the publication date (2021-01-13). There are no workarounds that mitigate the vulnerabilities. Disabling remote management reduces exposure but does not protect against local LAN attacks. Users should monitor Cisco's security advisories for future updates [1].