Cisco Small Business RV Series Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers (CVE-2021-1319) allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. The vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. Versions prior to the fixed releases are affected. [1]

Exploitation

An attacker must have valid administrator credentials on the affected device. With those credentials, the attacker sends crafted HTTP requests to the web-based management interface of the router. The improper input validation in the interface allows the attacker to trigger the vulnerability. [1]

Impact

A successful exploit allows the attacker to execute arbitrary code as the root user on the underlying operating system, or cause the device to reload, resulting in a denial of service (DoS) condition. This gives the attacker full control over the affected device or renders it unavailable. [1]

Mitigation

Cisco has released free software updates to address these vulnerabilities. Customers should upgrade to the fixed versions as indicated in the Cisco Security Advisory. No workarounds are available. Customers without service contracts should contact the Cisco TAC for upgrades. [1]