Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The web-based management interface of multiple Cisco Small Business routers, including the RV110W, RV130, RV130W, and RV215W, contains input validation flaws that allow an authenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. The vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. Affected devices have the remote management feature disabled by default, but if enabled, the interface is accessible via the WAN interface; otherwise, it is available only through a local LAN connection. No software updates have been released by Cisco as of the advisory date [1].

Exploitation

An attacker must have valid administrator credentials for the device. With these credentials, the attacker can send crafted HTTP requests to the web-based management interface. No additional privileges or user interaction beyond authentication are required. The attack can be carried out over the LAN, or over the WAN if remote management is enabled. The advisory does not detail specific steps but confirms the exploitation vector is authenticated HTTP requests [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code as the root user on the underlying operating system, leading to full compromise of the device. Alternatively, the attacker can cause the device to reload, resulting in a denial of service condition. Both outcomes give the attacker high impact on confidentiality, integrity, and availability [1].

Mitigation

Cisco has not released software updates that address these vulnerabilities. There are no workarounds available. The only mitigation is to disable remote management if not required and to ensure that only trusted users have administrative credentials. These devices may be at end of life; customers should consider upgrading to newer, supported models. The vulnerabilities are not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date [1].