Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

Multiple buffer overflow vulnerabilities exist in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers. These flaws are due to improper validation of user-supplied input in the web-based management interface. An authenticated attacker with valid administrator credentials can exploit these by sending crafted HTTP requests to an affected device. The affected firmware versions are those running on the listed router models; Cisco has not released software updates to address these vulnerabilities. [1]

Exploitation

An attacker must have valid administrator credentials to access the web-based management interface. The interface is accessible via a local LAN connection (which cannot be disabled) or via the WAN connection if remote management is enabled (disabled by default). The attacker sends crafted HTTP requests containing malformed input to trigger a buffer overflow in the web-based management interface. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. This gives the attacker full control over the affected router or disrupts its availability. [1]

Mitigation

Cisco has not released software updates that address these vulnerabilities. No workarounds are available. Disabling remote management (ensuring the device is only accessible from the local LAN) reduces exposure, but does not eliminate the attack vector since the web-based interface is always available on the LAN. Cisco has not listed these CVEs in the Known Exploited Vulnerabilities (KEV) catalog as of the advisory date. [1]