Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers contains multiple vulnerabilities due to insufficient validation of user fields within incoming HTTP packets [1]. These vulnerabilities affect all versions of the firmware on these devices [1]. The web-based management interface is accessible via LAN (cannot be disabled) or via WAN if the remote management feature is enabled (disabled by default) [1]. No software updates have been released to address these issues [1].

Exploitation

An attacker must have valid Administrator credentials for the affected device [1]. With authenticated access, the attacker can send a crafted request to the web-based management interface, exploiting the insufficient input validation to trigger the vulnerability [1]. The remote management feature over WAN is not required if the attacker already has LAN access.

Impact

A successful exploit allows an authenticated remote attacker to execute arbitrary commands on the affected device with root-level privileges, or to cause the device to restart unexpectedly, resulting in a denial of service (DoS) condition [1].

Mitigation

Cisco has not released software updates to address these vulnerabilities, and there are no workarounds available [1]. The following devices are affected: RV110W, RV130, RV130W, and RV215W [1]. Administrators should restrict management access to trusted networks only, disable remote management if not needed, and monitor for future firmware releases or alternative mitigation guidance from Cisco [1].