Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerabilities reside in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers [1]. They stem from insufficient validation of user-supplied fields within incoming HTTP packets. An attacker must have valid Administrator credentials to reach the vulnerable code path. The web-based management interface is accessible over LAN (cannot be disabled) and optionally over WAN if the remote management feature is enabled (disabled by default) [1]. All firmware versions of the listed models are affected.

Exploitation

An authenticated remote attacker with Administrator privileges can exploit these vulnerabilities by sending a crafted HTTP request to the web-based management interface [1]. The attacker can target the device over the LAN or, if remote management is enabled, over the WAN. No additional user interaction is required beyond the initial authentication.

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the affected device with root-level privileges, leading to full compromise of confidentiality, integrity, and availability [1]. Alternatively, the attacker can cause the device to restart unexpectedly, resulting in a denial of service (DoS) condition.

Mitigation

Cisco has not released software updates that address these vulnerabilities, and no workarounds are available [1]. Affected devices are end-of-life; Cisco recommends migrating to newer, supported models. Until migration is complete, administrators should restrict access to the web-based management interface to trusted networks only and disable remote management if not required.