Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

The vulnerabilities reside in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers [1]. They are caused by insufficient validation of user fields within incoming HTTP packets. An attacker must have valid Administrator credentials to reach the vulnerable code path. The web interface is accessible via LAN (which cannot be disabled) or WAN if remote management is enabled (disabled by default) [1]. No software updates have been released to address these issues [1].

Exploitation

An attacker needs valid Administrator credentials and network access to the device's web-based management interface [1]. The attacker sends a crafted HTTP request containing malicious input in user fields [1]. If remote management is disabled, the attacker must be on the LAN. The attack does not require user interaction beyond the authenticated session.

Impact

Successful exploitation allows an attacker to execute arbitrary commands on the affected device with root-level privileges or to cause the device to restart unexpectedly, resulting in a denial of service (DoS) condition [1]. This represents a full compromise of confidentiality, integrity, and availability on the device.

Mitigation

Cisco has not released software updates that address these vulnerabilities [1]. No workarounds are available [1]. As of the publication date (2022-07-21), these routers are end-of-life, and Cisco has stated there are no plans to release patches [1]. Administrators should restrict access to the web-based management interface to trusted networks only and disable remote management if not required.