Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerability

Vulnerability

The vulnerability resides in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers [1]. It is caused by insufficient user input validation of incoming HTTP packets [1]. Affected versions are those running firmware on the listed hardware models; no specific firmware version numbers are provided in the advisory [1]. The web interface is reachable via LAN or WAN if remote management is enabled (disabled by default) [1].

Exploitation

An unauthenticated, remote attacker can exploit this vulnerability by sending a crafted HTTP request to the web-based management interface [1]. No authentication or prior access is required. The attacker only needs network connectivity to the target device (LAN or WAN with remote management enabled) [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands with root-level privileges on the affected device [1]. This can lead to full device compromise, data exfiltration, or a denial-of-service (DoS) condition by causing an unexpected restart [1].

Mitigation

Cisco has not released software updates to address this vulnerability, and no workarounds are available [1]. The devices are end-of-life and end-of-support, meaning no patches will be provided [1]. Disabling remote management (default) reduces the attack surface but does not eliminate the risk from LAN access [1].