Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerabilities reside in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers (all firmware versions prior to the advisory date of January 13, 2021). Improper validation of user-supplied input allows an authenticated attacker to send crafted HTTP requests that trigger buffer overflows (CWE-121), leading to arbitrary code execution or device reboot [1].

Exploitation

An attacker must have valid administrator credentials to access the web-based management interface. The interface is reachable via LAN (cannot be disabled) or via WAN if remote management is enabled (disabled by default). The attacker sends crafted HTTP requests to the device; no user interaction beyond the initial authentication is needed [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code as root on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. The privileges gained are full administrative control over the device [1].

Mitigation

Cisco has not released software updates that address these vulnerabilities as of the advisory date. There are no workarounds available. The advisory recommends disabling remote management if enabled and restricting LAN access to trusted users. These vulnerabilities are not part of the Known Exploited Vulnerabilities (KEV) catalog as of the publication date [1].