Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerabilities reside in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers. They are due to improper validation of user-supplied input, leading to buffer overflow or command injection. All firmware versions of these models are affected. The interface is accessible over LAN (cannot be disabled) or over WAN if the remote management feature is enabled (disabled by default) [1].

Exploitation

An attacker must have valid administrator credentials for the device. With those credentials, the attacker can send crafted HTTP requests to the web-based management interface. No additional user interaction is required. The attack can be launched from the local network or remotely if remote management is enabled [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code as the root user on the underlying operating system, resulting in full compromise of the device. Alternatively, the attacker can cause the device to reload, leading to a denial of service (DoS) condition [1].

Mitigation

Cisco has not released software updates that address these vulnerabilities, and no workarounds are available. Disabling remote management reduces the attack surface but does not eliminate the risk because the interface remains accessible from the LAN. As of the publication date (2021-01-13), no fix exists [1].