Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerability is a set of buffer overflow issues (CWE-121) in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers. The affected versions are those running firmware prior to any fix, as Cisco has not released software updates. Improper validation of user-supplied input allows an attacker to overflow buffers by sending crafted HTTP requests. The web-based management interface is accessible via LAN (by default) or WAN if remote management is enabled [1].

Exploitation

An attacker must have valid administrator credentials for the targeted device. With authenticated access to the web-based management interface, the attacker sends specially crafted HTTP requests that trigger a buffer overflow. No user interaction is required beyond the initial authentication. The exploit does not require any special network position other than having network access to the interface (LAN or WAN with remote management enabled) [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code as the root user on the underlying operating system, gaining full control of the device. Alternatively, the attacker can cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. The compromise is at the highest privilege level and affects the confidentiality, integrity, and availability of the router [1].

Mitigation

Cisco has not released software updates that address these vulnerabilities. There are no workarounds available. The advisory recommends disabling remote management on the WAN interface if not required, but this does not mitigate LAN-based attacks. Given the lack of patch, affected devices should be replaced or isolated until a fix is available. These vulnerabilities are not listed on KEV as of the publication date [1].