Cisco Small Business RV Series Routers Vulnerabilities

Vulnerability

The web-based management interface of Cisco Small Business RV Series Routers contains multiple vulnerabilities, including command injection and authentication bypass. Affected versions are those running firmware prior to the fixed releases as specified in the Cisco advisory [1].

Exploitation

A remote attacker can exploit these vulnerabilities without authentication by sending specially crafted HTTP requests to the affected interface. The attacker can chain these vulnerabilities to execute arbitrary commands or bypass authentication and upload files [1].

Impact

Successful exploitation allows an attacker to execute arbitrary commands with elevated privileges, leading to full device compromise, or to bypass authentication and upload malicious files, potentially gaining persistent access [1].

Mitigation

Cisco has released free software updates to address these vulnerabilities. Customers are advised to upgrade to the fixed versions as detailed in the advisory [1]. No workarounds are available.