Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers contains multiple input validation vulnerabilities (CVE-2021-1187 and others listed in the advisory [1]). These flaws exist due to improper validation of user-supplied input, allowing crafted HTTP requests to cause buffer overflows. All firmware versions of the affected routers are vulnerable. Cisco has confirmed that no software updates are available to address these vulnerabilities [1].

Exploitation

An attacker must have valid administrator credentials for the affected device. The web-based management interface is accessible via local LAN (cannot be disabled) or via WAN if remote management is enabled (disabled by default) [1]. The attacker sends specially crafted HTTP requests to the device to trigger the overflow. No user interaction beyond the authenticated session is required.

Impact

Successful exploitation allows arbitrary code execution as the root user on the underlying operating system, giving the attacker full control of the device. Alternatively, the attacker can cause the device to reload, resulting in a denial of service (DoS) condition. Due to the lack of patches, these impacts persist indefinitely on unmitigated devices [1].

Mitigation

Cisco has not released and will not release software updates to address these vulnerabilities. The devices are end-of-life, and no workarounds are available [1]. Organizations should replace affected routers with supported models and ensure remote management is disabled (default) if decommissioning is not immediate.