Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerabilities reside in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers. The root cause is improper validation of user-supplied input, allowing crafted HTTP requests to trigger a stack-based buffer overflow (CWE-121). The affected devices run unpatched firmware; no software updates have been released. By default, the interface is accessible only via LAN, but if remote management is enabled, it is also reachable over the WAN. The affected product lines include all firmware versions prior to the advisory date [1].

Exploitation

An attacker must have valid administrator credentials for the affected device to send malicious HTTP requests. The attacker can exploit these vulnerabilities over the LAN or, if remote management is enabled, over the WAN. No user interaction beyond the authenticated session is required. The exploit involves sending crafted input that triggers a buffer overflow in the web-based management interface [1].

Impact

A successful exploit allows the attacker to execute arbitrary code as the root user on the underlying operating system, achieving full compromise of the device. Alternatively, the exploit can cause the device to reload, resulting in a denial of service (DoS) condition. There is no indication of a privilege escalation beyond root, but full device control enables further attacks on the network [1].

Mitigation

Cisco has not released software updates to fix these vulnerabilities, and there are no available workarounds. The only recommended mitigation is to disable remote management on the WAN interface (by unchecking the Enable box under Basic Settings > Remote Management) and to restrict LAN access to trusted administrators. These devices may be approaching end-of-life; however, Cisco has not listed them in the KEV catalog as of the advisory date [1].