Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The web-based management interface in Cisco Small Business RV110W, RV130, RV130W, and RV215W routers does not properly validate user-supplied input. These vulnerabilities are triggered when an authenticated attacker sends crafted HTTP requests to the device. The affected firmware versions have not been updated; Cisco has not released any software patches. The web interface is accessible via LAN (cannot be disabled) or via WAN if remote management is enabled (disabled by default). [1]

Exploitation

An attacker must have valid administrator credentials for the targeted device. With access to the web interface (over LAN or WAN if remote management is on), the attacker sends specially crafted HTTP requests. No user interaction is required beyond the initial authentication. The vulnerabilities are due to improper input validation, allowing the attacker to trigger a buffer overflow or similar condition. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary code as the root user on the underlying operating system, leading to full compromise of the device. Alternatively, the attacker could cause the device to reload (denial of service). The scope is limited to the affected router; no adjacent network compromise is described. [1]

Mitigation

Cisco has not released software updates that address these vulnerabilities as of the publication date. No workarounds are available. The advisory recommends disabling remote management if it is enabled and restricting administrative access to trusted users. Since the devices are not patched, users should consider replacing them if they are no longer supported. Cisco does not list these CVEs in the Known Exploited Vulnerabilities (KEV) catalog. [1]