Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerabilities reside in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers. Improper validation of user-supplied input in this interface allows an authenticated attacker who has valid administrator credentials to send crafted HTTP requests that trigger either arbitrary code execution or device reload. The web-based management interface is available through a local LAN connection or through the WAN connection if remote management is enabled (disabled by default). Cisco has not released software updates that address these vulnerabilities [1].

Exploitation

An attacker must have valid administrator credentials for the affected device. If remote management is enabled, the attack can be launched over the WAN; otherwise, the attacker must be on the local LAN. With administrator access, the attacker sends specially crafted HTTP requests to the web-based management interface. The request triggers the input validation flaw, leading to the intended outcome [1].

Impact

Successful exploitation allows the attacker to either execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. The code execution grants full control over the device. The DoS disrupts network services provided by the device [1].

Mitigation

Cisco has confirmed that no software updates are available to remediate these vulnerabilities. Additionally, no workarounds exist. Organizations should consider upgrading to a supported, non-vulnerable platform if possible. The devices are not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date. Administrators should restrict access to the web-based management interface to trusted IP addresses and disable remote management when not required [1].