Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerabilities reside in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers. They are due to improper validation of user-supplied input, leading to buffer overflows. Affected firmware versions for all specified router models are vulnerable; Cisco has not released patched software updates as of the advisory date [1]. The interface is accessible via LAN (cannot be disabled) or via WAN if remote management is enabled (disabled by default) [1].

Exploitation

An attacker must have valid administrator credentials for the affected device [1]. An authenticated attacker can exploit these vulnerabilities by sending specially crafted HTTP requests to the web-based management interface [1]. No user interaction beyond the attacker's own is required. The attack can be carried out over the local network or over the internet if remote management is enabled [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code as the root user on the underlying operating system of the router [1]. Alternatively, an attacker could cause the device to reload, resulting in a denial of service (DoS) condition [1]. A complete compromise of the device is possible.

Mitigation

Cisco has not released software updates that address these vulnerabilities [1]. There are no workarounds that address these vulnerabilities [1]. As of the advisory date, no mitigations are available. The vulnerabilities are not listed in the CISA Known Exploited Vulnerabilities catalog. Users should consider upgrading to a supported, non-vulnerable device if available.