Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers (all firmware versions) allow an authenticated remote attacker to execute arbitrary code or cause a denial of service. The vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. Affected products include all models listed in the Cisco advisory [1].

Exploitation

An attacker must have valid administrator credentials for the device. The web-based management interface is accessible via LAN (cannot be disabled) or via WAN if remote management is enabled (disabled by default). The attacker sends crafted HTTP requests to the interface, exploiting the input validation flaws. No user interaction is required beyond the initial authentication.

Impact

Successful exploitation allows the attacker to execute arbitrary code as the root user on the underlying operating system, leading to full compromise of the device. Alternatively, the attacker can cause the device to reload, resulting in a denial of service condition. The impact is complete loss of confidentiality, integrity, and availability.

Mitigation

Cisco has not released software updates that address these vulnerabilities as of the advisory publication date (January 13, 2021). There are no workarounds. The only mitigation is to restrict access to the web-based management interface to trusted users and disable remote management if not required. These devices may be end-of-life; consult Cisco for further guidance. [1]