Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

Multiple vulnerabilities (CVE-2022-20876) exist in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers. The bugs are due to insufficient validation of user fields within incoming HTTP packets. Affected devices include RV110W Wireless-N VPN Firewall, RV130 Wireless-N VPN Router, RV130W Wireless-N Multifunction VPN Router, and RV215W Wireless-N VPN Router. The web-based management interface is accessible via LAN (cannot be disabled) or via WAN if remote management is enabled (disabled by default). No software updates have been released [1].

Exploitation

An attacker must have valid Administrator credentials on the affected device. The attacker can then send a crafted HTTP request to the web-based management interface. No user interaction beyond initial authentication is required [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the device with root-level privileges, leading to full compromise, or to cause the device to restart unexpectedly, resulting in a denial of service (DoS) condition [1].

Mitigation

Cisco has not released software updates that address these vulnerabilities as of the advisory publication date (July 2022). There are no available workarounds. The advisory notes that these products have entered the end-of-life process and recommends customers migrate to supported devices [1].