Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

Multiple buffer overflow vulnerabilities exist in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers running vulnerable firmware. The vulnerabilities are due to improper validation of user-supplied input before being processed by the affected code path in the web interface [1]. An attacker can craft specific HTTP requests to trigger an overflow. The remote management feature (disabled by default) exposes the interface over the WAN, but even without it the interface is accessible via LAN [1]. No fix has been released as of the advisory date.

Exploitation

An attacker must first authenticate with valid administrator credentials to the web management interface [1]. The interface is accessible over LAN by default, or over WAN if remote management is enabled. The attacker then sends specially crafted HTTP requests to an affected device. No user interaction beyond the initial authentication is required [1]. The attacker can reuse the same credentials across multiple CVEs (CVE-2021-1159 through CVE-2021-1171).

Impact

Successful exploitation allows an attacker to execute arbitrary code with root privileges on the underlying operating system, or cause the device to reload (denial of service) [1]. Full compromise of the router is possible, enabling network traffic interception, further lateral movement, or persistent device disruption.

Mitigation

Cisco has not released software updates that address these vulnerabilities. No workarounds are available [1]. Administrators should disable remote management if not needed, restrict LAN access to trusted users, and monitor for future firmware updates. These products may be approaching end of life; upgrade to a supported model is recommended.