Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerability is a set of multiple issues in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers [1]. The root cause is insufficient validation of user fields within incoming HTTP packets. This affects the web-based management interface, which is reachable via LAN (always enabled) or via WAN if remote management is enabled. All versions of these routers are affected as no fix is available [1].

Exploitation

An attacker must have valid Administrator credentials to send a crafted HTTP request to the web-based management interface [1]. The attacker then sends a specially crafted request containing malicious input in user-controlled fields. No additional user interaction is required beyond the authenticated session. The attack is remote, requiring network access to the device's management interface [1].

Impact

Successful exploitation allows an attacker to execute arbitrary commands on the affected device with root-level privileges, or to cause the device to restart unexpectedly, resulting in a denial of service (DoS) condition [1]. This means full compromise of confidentiality, integrity, and availability of the device.

Mitigation

Cisco has not released software updates that address these vulnerabilities, nor are there any workarounds available [1]. As of the advisory date, no fix exists. Administrators should consider disabling remote management if enabled, restrict administrative access to trusted IP addresses, and monitor for unauthorized access [1].