Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers [1]. These issues stem from insufficient validation of user-supplied fields within incoming HTTP packets. An attacker can exploit this by sending a crafted request to the management interface. The affected devices run firmware versions that have not been patched; Cisco has not released software updates addressing these vulnerabilities [1].

Exploitation

To exploit these vulnerabilities, an attacker must have valid Administrator credentials for the targeted device [1]. The attacker then sends a specially crafted HTTP request to the web-based management interface, which is accessible via LAN (always enabled) or WAN if remote management is enabled (disabled by default) [1]. No additional user interaction is required beyond authentication.

Impact

Successful exploitation allows an attacker to execute arbitrary commands on the affected device with root-level privileges, leading to full compromise of the router [1]. Alternatively, the attacker can cause the device to restart unexpectedly, resulting in a denial-of-service (DoS) condition [1].

Mitigation

As of the publication date (2022-07-21), Cisco has not released software updates to fix these vulnerabilities, and no workarounds are available [1]. Disabling remote management on the WAN interface reduces the attack surface but does not eliminate the risk because the LAN interface remains accessible [1]. Users should monitor Cisco's advisory for future updates or consider replacing end-of-life devices.