Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerabilities exist in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers [1]. The root cause is insufficient validation of user fields within incoming HTTP packets, allowing an attacker to inject malicious content [1]. Affected versions are those running firmware prior to any fix; the advisory notes that Cisco has not released software updates addressing these vulnerabilities, meaning all currently supported versions are considered affected [1]. The web-based interface is available via LAN connection and optionally via WAN if remote management is enabled (disabled by default) [1].

Exploitation

An attacker must first obtain valid Administrator credentials for the target device [1]. With these credentials, the attacker sends a crafted HTTP request to the web-based management interface that exploits the insufficient input validation [1]. The advisory describes this as a remote, authenticated exploit; no user interaction beyond authentication is required [1]. The attacker can be on the local network or, if remote management is enabled, on the WAN side [1].

Impact

Successful exploitation can result in either arbitrary command execution on the affected device with root-level privileges, or a denial of service (DoS) condition by causing the device to restart unexpectedly [1]. This gives the attacker full control over the router (RCE) or can disrupt network connectivity (availability impact) [1].

Mitigation

Cisco has not released software updates that address these vulnerabilities and has stated there are no workarounds [1]. As of the publication date (2022-07-21), no fix is available [1]. Users concerned about exposure should limit administrative access to trusted IP addresses, ensure the remote management feature remains disabled unless absolutely required, and monitor the Cisco advisory page for future updates [1].