Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerability resides in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers. It is due to improper validation of user-supplied input in the interface. An authenticated attacker with administrator credentials can send crafted HTTP requests to exploit the flaw. All firmware versions for these models are affected; Cisco has not released software updates to address this vulnerability. [1]

Exploitation

An attacker must have valid administrator credentials for the device. The web-based management interface is accessible via a local LAN connection (which cannot be disabled) or via the WAN connection if the remote management feature is enabled (disabled by default). The attacker sends specially crafted HTTP requests to the interface, exploiting the input validation weakness. No additional user interaction is required beyond the attacker's own actions. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary code as the root user on the underlying operating system, leading to full compromise of the device. Alternatively, the attacker can cause the device to reload, resulting in a denial of service (DoS) condition. [1]

Mitigation

Cisco has not released software updates to address these vulnerabilities as of the advisory date (January 13, 2021). No workarounds are available. The only mitigation is to restrict access to the web-based management interface by disabling remote management if not needed and ensuring only trusted users have administrator credentials. The devices are not listed on the CISA Known Exploited Vulnerabilities catalog (as of writing). [1]