Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers contains multiple vulnerabilities due to improper validation of user-supplied input [1]. An authenticated attacker can send crafted HTTP requests to trigger the flaw. All firmware versions are affected as no software updates have been released. The interface is accessible via LAN by default, and via WAN if remote management is enabled.

Exploitation

An attacker must have valid administrator credentials for the device. They then send specially crafted HTTP requests to the web-based management interface. If remote management is enabled, the attack can be launched from the WAN side; otherwise, it requires local network access [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code as the root user on the underlying operating system, leading to full compromise of the device. Alternatively, the attacker can cause the device to reload, resulting in a denial of service (DoS) condition [1].

Mitigation

Cisco has not released software updates to address these vulnerabilities, and no workarounds are available [1]. Users should consider restricting access to the web-based management interface to trusted networks only, and disable remote management if not required. As of the publication date (2021-01-13), no fix exists.