Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers contains multiple vulnerabilities (CVE-2021-1159, CVE-2021-1160, CVE-2021-1161) that allow an authenticated, remote attacker to execute arbitrary code or cause an unexpected device reload. The issues stem from improper validation of user-supplied input in the web-based management interface. These vulnerabilities affect all firmware versions of the listed models. The web interface is accessible through a local LAN connection (which cannot be disabled) or through the WAN connection if remote management is enabled (disabled by default) [1].

Exploitation

An attacker must have valid administrator credentials for the target device. The attacker then sends specially crafted HTTP requests to the web-based management interface. No user interaction beyond the initial authentication is required. If remote management is enabled, the attack can be launched from the WAN side; otherwise, the attacker must be on the local LAN [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code with root privileges on the underlying operating system, leading to full compromise of the device. Alternatively, the attacker can cause the device to reload, resulting in a denial of service (DoS) condition that disrupts network connectivity for all users behind the router [1].

Mitigation

Cisco has not released software updates to address these vulnerabilities as of the publication date (January 13, 2021). No workarounds are available. The only mitigations are to ensure that remote management is disabled (default) and to restrict LAN access to trusted administrators. The devices are not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of this writing [1].