Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers. These are due to improper validation of user-supplied input in the interface. An attacker can exploit these by sending crafted HTTP requests to an affected device. The web-based management interface is accessible via LAN (cannot be disabled) or via WAN if remote management is enabled (disabled by default). The affected firmware versions are those before any patch, but no specific version numbers are provided. All versions are vulnerable until patched. [1]

Exploitation

To exploit these vulnerabilities, an attacker must have valid administrator credentials for the affected device. With those credentials, the attacker can send specially crafted HTTP requests to the web-based management interface either over LAN or WAN (if remote management is enabled). No user interaction is required beyond the authentication step. The vulnerabilities require no additional privileges beyond admin. [1]

Impact

Successful exploitation allows an attacker to execute arbitrary code with root privileges on the underlying operating system, or cause the device to reload, resulting in a denial of service condition. The attacker gains full control over the device or can disrupt its operation. [1]

Mitigation

As of the publication date (2021-01-13), Cisco has not released software updates to address these vulnerabilities. No workarounds are available. The devices may be approaching end-of-life; however, the advisory does not provide a specific EOL status. Administrators are advised to restrict access to the web-based management interface to trusted users only, and disable remote management if not required. [1]