Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerabilities reside in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers. The root cause is improper validation of user-supplied input in the interface, allowing an attacker to send crafted HTTP requests that can lead to buffer overflow conditions. These flaws are tracked as CVE-2021-1184 and are part of a family of vulnerabilities (also including CVE-2021-1159, CVE-2021-1160, CVE-2021-1161) affecting the same product line [1]. The web interface is accessible via a local LAN connection (cannot be disabled) or through the WAN if remote management is enabled (disabled by default) [1]. No fixed versions have been released; all firmware versions are considered vulnerable [1].

Exploitation

An attacker must first obtain valid administrator credentials for the targeted device. With those credentials, the attacker can send specially crafted HTTP requests to the web-based management interface [1]. The requests exploit the improper input validation to trigger a buffer overflow. No user interaction beyond the attacker's own actions is required, and the attack can be launched from the LAN or from the WAN if remote management is enabled [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code as the root user on the underlying operating system, gaining full control of the device. Alternatively, an attacker could cause the device to reload, leading to a denial of service (DoS) condition [1]. The compromise is complete, affecting confidentiality, integrity, and availability.

Mitigation

As of the publication date (2021-01-13), Cisco has not released software updates to address these vulnerabilities, nor are there any workarounds available [1]. The devices are end-of-life (EOL) for some models, but Cisco has not provided a specific EOL status for all affected models in the advisory. No known exploitation in the wild (KEV) has been reported. Users should consider upgrading to non-vulnerable products as the only mitigation [1].