Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers contains multiple vulnerabilities due to improper validation of user-supplied input [1]. An authenticated attacker can send crafted HTTP requests to trigger buffer overflows or other memory corruption issues. The affected firmware versions are those running on the listed hardware; Cisco has not released software updates to address these vulnerabilities [1].

Exploitation

An attacker must have valid administrator credentials for the device. The web-based management interface is accessible via LAN (cannot be disabled) or via WAN if remote management is enabled (disabled by default) [1]. The attacker sends specially crafted HTTP requests to the vulnerable interface, exploiting the input validation flaws to cause a buffer overflow or similar condition.

Impact

Successful exploitation allows the attacker to execute arbitrary code as the root user on the underlying operating system, leading to full compromise of the device. Alternatively, the attacker can cause the device to reload, resulting in a denial of service (DoS) condition [1].

Mitigation

Cisco has not released software updates that address these vulnerabilities. There are no workarounds available [1]. Users should consider disabling remote management if enabled and restrict access to the management interface to trusted networks. However, these are not official mitigations. The devices may be end-of-life; check Cisco support for further guidance.