Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerabilities exist in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers. They are due to improper validation of user-supplied input. An authenticated attacker with administrator credentials can send crafted HTTP requests to trigger the flaws. Affected versions include all firmware releases for these models; Cisco has not released software updates [1].

Exploitation

An attacker must have valid administrator credentials for the device. The web-based management interface is accessible via LAN (cannot be disabled) or via WAN if remote management is enabled (disabled by default). The attacker sends specially crafted HTTP requests to the interface. No user interaction is required beyond the initial authentication [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code as the root user on the underlying operating system, leading to full compromise. Alternatively, the attacker can cause the device to reload, resulting in a denial of service condition [1].

Mitigation

Cisco has not released software updates to address these vulnerabilities as of the advisory date (January 13, 2021). No workarounds are available [1]. Users should consider upgrading to newer, supported models if possible. The vulnerabilities are not listed on CISA's Known Exploited Vulnerabilities catalog as of the publication date.