Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerabilities reside in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers. They stem from improper validation of user-supplied input, leading to stack-based buffer overflows (CWE-121). All firmware versions of these devices are affected. The web-based management interface is accessible via LAN by default, and optionally via WAN if remote management is enabled [1].

Exploitation

An attacker must have valid administrator credentials for the affected device. With authenticated access, the attacker sends crafted HTTP requests to the web-based management interface. If remote management is enabled, the attacker can exploit the vulnerability from the WAN side; otherwise, LAN access is required. The attack does not require user interaction beyond initial authentication [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code as the root user on the underlying operating system, gaining full control of the device. Alternatively, the attacker could cause the device to reload, resulting in a denial of service (DoS) condition. The compromise is complete, affecting confidentiality, integrity, and availability [1].

Mitigation

As of the advisory publication date (January 13, 2021), Cisco has not released software updates to address these vulnerabilities. No workarounds are available. Administrators are advised to restrict access to the web-based management interface to trusted networks and disable remote management if not required. The vulnerabilities are not listed in the Known Exploited Vulnerabilities (KEV) catalog [1].