Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerabilities reside in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers. The flaws are due to improper validation of user-supplied input. An authenticated attacker with administrator credentials can send crafted HTTP requests to trigger a buffer overflow. Affected devices include all firmware versions; Cisco has not released software updates to address these vulnerabilities [1].

Exploitation

An attacker must have valid administrator credentials for the targeted device. The web-based management interface is accessible via a local LAN connection (which cannot be disabled) or via the WAN connection if the remote management feature is enabled (default: disabled). The attacker sends specially crafted HTTP requests to the vulnerable interface, exploiting the improper input validation to overflow a buffer [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code as the root user on the underlying operating system, leading to full compromise of the device. Alternatively, the attacker could cause the device to reload (denial of service). The impact is complete loss of confidentiality, integrity, and availability of the affected router [1].

Mitigation

Cisco has not released software updates that address these vulnerabilities. There are no workarounds. The devices are not listed in the KEV catalog as of this writing. Users should restrict access to the web-based management interface to trusted networks only and disable remote management if not required. Affected products may be approaching or at end-of-life; upgrading to a supported model is recommended [1].