Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

Multiple vulnerabilities (CVE-2021-1159, CVE-2021-1160, CVE-2021-1161, and this one) in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers are due to improper validation of user-supplied input [1]. The interface is accessible via LAN (cannot be disabled) or WAN if remote management is enabled. Affected versions include all firmware releases for these models as of the advisory date; no fixed version has been released [1].

Exploitation

An attacker must have valid administrator credentials for the target device [1]. The exploit is executed by sending crafted HTTP requests to the web-based management interface; no user interaction beyond authentication is required [1]. The vulnerabilities do not require any special network position beyond network access to the management interface (LAN or WAN if remote management is enabled) [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands as the root user on the underlying operating system, leading to complete compromise of the device, or to cause the device to reload, resulting in a denial of service condition [1].

Mitigation

Cisco has not released software updates that address these vulnerabilities as of the publication date [1]. No workarounds are available [1]. The only recommended mitigation is to disable remote management if enabled and restrict LAN access to trusted administrators [1]. These devices are not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date.