Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers is susceptible to multiple vulnerabilities due to improper validation of user-supplied input [1]. An authenticated attacker can send crafted HTTP requests to trigger command injection or a stack-based buffer overflow (CWE-121) [1]. The management interface is reachable via LAN or WAN (if remote management is enabled) [1]. All firmware versions on the listed hardware are affected; Cisco has not released patches [1].

Exploitation

To exploit, an attacker must have valid administrator credentials for the device [1]. No user interaction beyond the attacker's own actions is required. The attacker sends specially crafted HTTP requests to the web-based management interface [1]. The input validation flaw allows the attacker to overwrite memory or inject operating system commands [1].

Impact

A successful exploit can allow the attacker to execute arbitrary commands as the root user on the underlying operating system, or cause the device to reload, resulting in a denial of service condition [1]. Full system compromise is possible, with potential for data exfiltration, further lateral movement, or persistent disruption of network connectivity.

Mitigation

Cisco has not released software updates to address these vulnerabilities and there are no workarounds [1]. Disabling remote management (default) reduces WAN-based attack surface but does not block LAN access [1]. Organizations should isolate affected devices in a separate VLAN and restrict administrative access, or replace the routers with supported models [1].