Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerability is a stack-based buffer overflow in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers, due to improper validation of user-supplied input. An attacker can send crafted HTTP requests to trigger the overflow, leading to arbitrary code execution or device reload. Affected firmware versions have not been disclosed, but these routers are end-of-life and no patches exist [1]. The web interface is accessible via LAN or WAN (if remote management is enabled).

Exploitation

An attacker must have valid administrator credentials on the device. With authenticated access, the attacker sends specially crafted HTTP requests to the web-based management interface. No user interaction is required beyond authentication. The attack can be conducted over the network, locally or remotely if remote management is enabled [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code as the root user on the underlying operating system, gaining full control of the device. Alternatively, the attacker can cause the device to reload, resulting in a denial of service (DoS) condition [1].

Mitigation

Cisco has not released and will not release software updates to address these vulnerabilities because the affected products are end-of-life. No workarounds are available [1]. Users should upgrade to a supported, non-vulnerable product. These vulnerabilities are not listed in CISA's Known Exploited Vulnerabilities catalog as of this writing.