Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers [1]. The interface is accessible through a local LAN connection or via WAN if the remote management feature is enabled (disabled by default). The vulnerabilities are due to improper validation of user-supplied input, leading to buffer overflows. All firmware versions of these devices are affected [1].

Exploitation

An attacker must have valid administrator credentials for the targeted device [1]. The attacker sends crafted HTTP requests to the web-based management interface. If remote management is enabled, the attack can be launched from the WAN side; otherwise, the attacker must be on the local LAN. No additional user interaction is required. The exploit sequence involves authenticating to the device and then sending a malicious HTTP request that triggers the input validation flaw [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code as the root user on the underlying operating system, leading to full compromise of the device. Alternatively, the attacker can cause the device to reload, resulting in a denial of service (DoS) condition [1].

Mitigation

Cisco has not released software updates that address these vulnerabilities, and there are no workarounds [1]. Users should disable remote management if it is not required, and restrict LAN access to trusted administrators. As these devices may be end-of-life, upgrading to a supported model is recommended [1].