Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers. These issues are due to insufficient validation of user fields within incoming HTTP packets. Affected firmware versions have not been explicitly listed, but the advisory covers all releases prior to the publication date of 2022-07-21 [1]. The management interface is accessible via LAN or, if enabled, remotely via WAN; remote management is disabled by default [1].

Exploitation

An attacker must first obtain valid Administrator credentials for an affected device. With these credentials, the attacker sends a crafted HTTP request to the web-based management interface. No user interaction beyond the authenticated session is required; the vulnerability exists in the parsing of user-supplied fields [1].

Impact

A successful exploit allows the attacker to either execute arbitrary commands with root-level privileges on the device or trigger an unexpected restart, resulting in a denial-of-service (DoS) condition. Both outcomes represent a full compromise of the router's confidentiality, integrity, and availability [1].

Mitigation

Cisco has not released software updates addressing these vulnerabilities as of the advisory publication date (2022-07-21). No workarounds are available [1]. The only recommended mitigation is to restrict access to the web-based management interface to trusted users and networks, and to disable the remote management feature if not required [1].