Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers contains multiple input validation vulnerabilities (CVE-2021-1168 and related CVEs) that allow arbitrary code execution or denial of service. The vulnerabilities stem from improper validation of user-supplied input. All firmware versions of the affected products are considered vulnerable. The interface is accessible via LAN (cannot be disabled) or WAN if remote management is enabled (disabled by default) [1].

Exploitation

An attacker must have valid administrator credentials for the affected device to send crafted HTTP requests to the web-based management interface. No additional user interaction is required beyond authenticating as an administrator. The attacker can then exploit the improper input validation to trigger a buffer overflow or similar condition [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. This gives the attacker full control over the router and potentially the network it manages [1].

Mitigation

Cisco has not released software updates to address these vulnerabilities as of the advisory publication date (January 13, 2021). There are no workarounds available. Administrators should consider disabling remote management and restricting LAN access to the management interface as a partial mitigation, but the vulnerabilities remain exploitable from the LAN side [1].