Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerabilities exist in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers [1]. Due to improper validation of user-supplied input in the web-based management interface, an authenticated remote attacker can send crafted HTTP requests to execute arbitrary code or cause a device reload [1]. Affected versions: all versions of these devices, as no software updates have been released [1].

Exploitation

An attacker needs valid administrator credentials to access the web-based management interface, which is available via local LAN (cannot be disabled) or via WAN if remote management is enabled (default disabled) [1]. The attacker then sends crafted HTTP requests to the affected device [1]. No user interaction is required beyond authentication.

Impact

Successful exploitation allows the attacker to execute arbitrary code as the root user on the underlying operating system, or cause the device to reload, resulting in a denial of service (DoS) condition [1].

Mitigation

Cisco has not released software updates that address these vulnerabilities [1]. There are no workarounds [1]. Users should disable remote management if enabled, and restrict access to the web-based management interface to trusted networks. However, the local LAN interface cannot be disabled. The devices may be end-of-life; consult Cisco support for further guidance. Not listed in the Known Exploited Vulnerabilities (KEV) catalog.