Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerabilities reside in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers. The interface is accessible via a local LAN connection (which cannot be disabled) or via WAN if the remote management feature is enabled (disabled by default). Improper validation of user-supplied input in the interface allows an authenticated attacker to trigger memory corruption. No software updates have been released by Cisco to address these issues [1].

Exploitation

An attacker must have valid administrator credentials for the affected device. With those credentials, the attacker can send crafted HTTP requests to the web-based management interface. No additional user interaction is required. The attack can be launched from the local LAN or, if remote management is enabled, from the WAN side [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code as the root user on the underlying operating system, leading to full compromise of the device. Alternatively, the attacker can cause the device to reload, resulting in a denial of service (DoS) condition [1].

Mitigation

Cisco has not released software updates that address these vulnerabilities. No workarounds are available. As these devices are end-of-life, users are advised to consider migration to supported products. Disabling remote management (if enabled) reduces the attack surface but does not prevent exploitation from the LAN [1].