Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerability exists in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers due to improper validation of user-supplied input. An authenticated remote attacker with valid administrator credentials can exploit this by sending crafted HTTP requests to the affected device. The issue affects all firmware versions of these models [1].

Exploitation

An attacker must have valid administrator credentials to access the web-based management interface via a local LAN connection (which cannot be disabled) or via WAN if remote management is enabled. The attacker then sends specially crafted HTTP requests to trigger the vulnerability. No user interaction is required beyond the initial authentication [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code as the root user on the underlying operating system, leading to full compromise of the device. Alternatively, the attacker could cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition [1].

Mitigation

Cisco has not released software updates to address these vulnerabilities as of the publication date (January 13, 2021). There are no workarounds available. Users are advised to monitor the Cisco advisory for future updates and consider restricting access to the web-based management interface to trusted networks only [1].