Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers is affected by multiple remote command execution and denial-of-service vulnerabilities (CVE-2021-1165). The defects reside in the improper validation of user-supplied input within the web management interface. Affected firmware versions are those running on the listed hardware models; Cisco has not provided specific version details. The web-based management interface is accessible via a local LAN connection (which cannot be disabled) or through the WAN connection if the remote management feature is enabled (disabled by default) [1].

Exploitation

An attacker must have valid administrator credentials for the affected device. With those credentials, the attacker can send crafted HTTP requests to the web-based management interface. The vulnerable code path is reachable through the management interface, either locally or remotely if remote management is enabled [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code as the root user on the underlying operating system, or to cause the device to reload, resulting in a denial-of-service (DoS) condition [1].

Mitigation

As of the publication date (2021-01-13), Cisco has not released software updates to address these vulnerabilities. No workarounds are available [1]. Administrators should restrict access to the management interface to trusted networks and disable remote management unless absolutely necessary [1].