Cisco Small Business RV Series Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers (CVE-2021-1342) allow an authenticated, remote attacker to execute arbitrary code or cause a denial of service. The flaws stem from improper validation of user-supplied input in the web-based management interface. Affected firmware versions are those prior to the fixed releases specified in Cisco's advisory [1].

Exploitation

An attacker must have valid administrator credentials for the affected device. The exploit involves sending crafted HTTP requests to the web-based management interface. No user interaction beyond the initial authentication is required. The attack is remote and can be carried out over the network [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code as the root user on the underlying operating system, gaining full control of the device, or cause the device to reload, resulting in a denial of service (DoS) condition. The compromise is at the highest privilege level and affects the entire device [1].

Mitigation

Cisco has released free software updates to address these vulnerabilities. Users should upgrade to the fixed firmware versions as detailed in the Cisco Security Advisory [1]. No workarounds are available. Devices that have reached end-of-life are not covered; customers should migrate to supported models.