Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers contains multiple vulnerabilities caused by insufficient validation of user fields within incoming HTTP packets [1]. An authenticated, remote attacker with valid Administrator credentials can exploit these issues to execute arbitrary code or cause a denial of service [1]. The affected firmware versions are those running on these specific router models, and Cisco has not released software updates to address the vulnerabilities [1].

Exploitation

An attacker must first obtain valid Administrator credentials for the targeted device [1]. The attacker then sends a crafted HTTP request to the web-based management interface, which fails to properly validate the user-supplied fields [1]. The management interface is accessible via a LAN connection (which cannot be disabled) or via WAN if remote management is enabled (disabled by default) [1]. No user interaction beyond the authenticated session is required.

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the affected device with root-level privileges, or to cause the device to restart unexpectedly, resulting in a denial of service (DoS) condition [1]. This enables full compromise of the router's confidentiality, integrity, and availability from a remote authenticated position.

Mitigation

Cisco has not released software updates that address these vulnerabilities, and there are no workarounds that mitigate them [1]. The affected devices are end-of-life, and no patches are planned. Organizations should consider upgrading to currently supported Cisco Small Business routers that are not affected by these vulnerabilities [1].