Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerabilities reside in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers [1]. They are due to insufficient validation of user-supplied fields within incoming HTTP packets. An attacker must have valid Administrator credentials to reach the vulnerable code path. The web-based management interface is accessible over LAN and optionally over WAN if remote management is enabled (disabled by default). All firmware versions are affected as no patch has been released.

Exploitation

An authenticated remote attacker with Administrator privileges can exploit these vulnerabilities by sending a crafted HTTP request to the web-based management interface [1]. The attacker can target the device over the LAN connection, or over the WAN if the remote management feature is enabled. No additional user interaction is required beyond the initial authentication.

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the affected device with root-level privileges, leading to full compromise of confidentiality, integrity, and availability [1]. Alternatively, the attacker can cause the device to restart unexpectedly, resulting in a denial of service (DoS) condition.

Mitigation

Cisco has not released software updates to address these vulnerabilities, and there are no available workarounds [1]. Disabling remote management reduces the attack surface but does not eliminate the risk because the interface is always accessible from the LAN. Users should consider replacing affected devices if they reach end-of-life or if no patch becomes available.