Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerabilities (CVE-2021-1216) affect the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers. They are caused by improper validation of user-supplied input in the web-based management interface. An authenticated, remote attacker can send crafted HTTP requests to trigger a buffer overflow or command injection. No software updates have been released by Cisco as of the advisory date (January 2021). [1]

Exploitation

An attacker must have valid administrator credentials on the affected device. With those credentials, the attacker can send specially crafted HTTP requests to the web-based management interface. The remote management feature is disabled by default but can be enabled; exploitation is possible via LAN without it. No user interaction beyond the attacker's own actions is required. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary code as the root user on the underlying operating system, or cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This grants full compromise of the router's operating system and network functionality. [1]

Mitigation

As of the publication date, Cisco has not released software updates to address these vulnerabilities. No workarounds are available. Affected devices reached end of life for most models prior to this advisory. Organizations should consider replacing devices that have reached end of life. [1]