Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers is affected by multiple vulnerabilities (CVE-2021-1159, CVE-2021-1160, CVE-2021-1161) that allow remote code execution and denial of service. The vulnerabilities stem from improper validation of user-supplied input in the web-based management interface [1]. An attacker can trigger the flaw by sending crafted HTTP requests to the interface. The management interface is reachable over LAN (cannot be disabled) or over WAN if remote management is enabled (disabled by default). All versions of the affected devices are considered vulnerable, as Cisco has not released software updates [1].

Exploitation

To exploit these vulnerabilities, an attacker must have valid administrator credentials for the affected device [1]. The attacker sends specially crafted HTTP requests to the web-based management interface. No user interaction is required beyond the attacker authenticating as an administrator. The remote management feature, if enabled, exposes the interface over the WAN, increasing the attack surface [1].

Impact

A successful exploit allows the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service condition [1]. This gives the attacker full control over the device, potentially enabling further attacks on the network.

Mitigation

As of the publication date (January 13, 2021), Cisco has not released software updates to address these vulnerabilities [1]. No workarounds are available. The recommended mitigation is to disable the remote management feature (if enabled) and restrict access to the management interface to trusted, internal networks. These devices may be end-of-life, but Cisco has not confirmed this in the advisory [1].