Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerabilities affect the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers. They stem from improper validation of user-supplied input, allowing crafted HTTP requests to trigger buffer overflows. The devices have these interfaces available via LAN (cannot be disabled) or WAN if remote management is enabled (default: disabled). No software updates have been released [1].

Exploitation

An attacker must have valid administrator credentials and send specially crafted HTTP requests to the affected device. If remote management is enabled on the WAN, the attack can be launched from the internet; otherwise, it requires LAN access [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code as root or cause a denial of service by reloading the device. The attacker can achieve complete compromise of the router, including full control over the operating system [1].

Mitigation

Cisco has not released software updates or workarounds as of the advisory date (January 13, 2021). Users should consider disabling remote management on the WAN interface if not needed, restrict LAN access to trusted administrators, or replace the devices if they reach end-of-life. The vulnerabilities are not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of this writing [1].