Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerabilities reside in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers. They stem from improper validation of user-supplied input in the interface. Attackers can exploit these by sending crafted HTTP requests. All firmware versions of these devices are affected, and the remote management feature, if enabled, exposes the interface over the WAN [1].

Exploitation

An attacker must have valid administrator credentials for the targeted device. With these, they can send specially crafted HTTP requests to the web-based management interface. No user interaction is required beyond the initial authentication. The attack can be launched from the local LAN or, if remote management is enabled, from the internet [1].

Impact

Successful exploitation could allow an attacker to execute arbitrary code as the root user on the underlying operating system, leading to full compromise of confidentiality, integrity, and availability. Alternatively, the attacker could cause the device to reload, resulting in a denial of service condition [1].

Mitigation

As of the publication date (January 13, 2021), Cisco has not released software updates to address these vulnerabilities. No workarounds are available. The advisory recommends monitoring for future updates from Cisco. The vulnerabilities are not listed in the Known Exploited Vulnerabilities (KEV) catalog [1].