Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerability resides in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers. It stems from improper validation of user-supplied input in the interface. All firmware versions of these devices are affected, as Cisco has not released software updates to address this issue [1].

Exploitation

An attacker must have valid administrator credentials for the affected device. The web-based management interface is accessible over the local LAN (cannot be disabled) or over the WAN if remote management is enabled (disabled by default). The attacker sends crafted HTTP requests to the interface to trigger the vulnerability [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. This gives the attacker full control over the device or disrupts its availability [1].

Mitigation

Cisco has not released software updates that address these vulnerabilities, and no workarounds are available. Users may consider disabling remote management if enabled, but this does not fully mitigate the risk as the LAN interface remains exposed. The devices are not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date [1].