Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers due to improper validation of user-supplied input. Affected firmware versions are those prior to any fix; as of the advisory date, no software updates have been released [1]. The web-based management interface is accessible via LAN or WAN if remote management is enabled (disabled by default).

Exploitation

An attacker requires valid administrator credentials for the target device. With these credentials, the attacker can send crafted HTTP requests to the web-based management interface over the network (LAN or WAN if remote management is enabled). The improper input validation allows the attacker to trigger buffer overflows or other memory corruption, leading to arbitrary code execution or denial of service.

Impact

Successful exploitation enables the attacker to execute arbitrary code as the root user on the underlying operating system, granting full control of the device. Alternatively, the attacker can cause the device to reload unexpectedly, resulting in a denial of service condition. This can disrupt network operations and potentially expose sensitive data.

Mitigation

As of January 2021, Cisco has not released software updates to address these vulnerabilities, and there are no workarounds [1]. Administrators should restrict access to the web-based management interface by ensuring remote management is disabled unless absolutely necessary, and limit LAN access to trusted users. Monitoring for any signs of compromise is also recommended.