Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerabilities reside in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers. The flaws are due to improper validation of user-supplied input, allowing an authenticated, remote attacker to execute arbitrary code or cause the device to restart unexpectedly. The affected products are those running the standard web-based management interface accessible via LAN (and optionally via WAN if remote management is enabled). No fixed software versions have been released; all versions of the listed models are affected [1].

Exploitation

An attacker must have valid administrator credentials on the affected device. To exploit the vulnerability, the attacker sends crafted HTTP requests to the device's web-based management interface. The attack can be launched from the local LAN (where the interface is always present) or from the WAN if the remote management feature is enabled. No user interaction beyond the attacker's authenticated session is required [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code with root privileges on the underlying operating system, leading to full compromise of the device. Alternatively, the attacker can trigger a device reload, causing a denial of service (DoS) condition. The scope is limited to the affected router, but due to root access, the attacker could potentially pivot to other network segments [1].

Mitigation

Cisco has not released software updates addressing these vulnerabilities, and there are no available workarounds. The advisory recommends disabling remote management if not needed and restricting LAN access to trusted administrators. As of January 2021, these routers have reached end-of-life or end-of-support; customers are advised to migrate to a supported product [1].