Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities

Vulnerability

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers (all firmware versions) allow an authenticated, remote attacker to execute arbitrary commands or cause a denial of service (DoS). The issues arise due to insufficient validation of user fields within incoming HTTP packets [1]. The web-based management interface is accessible via LAN (and WAN if remote management is enabled, which is disabled by default).

Exploitation

An attacker must have valid Administrator credentials on the affected device [1]. The attacker then sends a crafted HTTP request to the web-based management interface, exploiting the insufficient input validation to trigger a buffer overflow or command injection [1]. The attack can be carried out remotely if remote management is enabled, or from the LAN.

Impact

A successful exploit allows the attacker to execute arbitrary commands with root-level privileges on the device, or to cause the device to restart unexpectedly, resulting in a complete denial of service condition [1]. The entire device is compromised, with no privilege boundaries.

Mitigation

Cisco has not released software updates to address these vulnerabilities as of the publication date (2022-07-21) [1]. No workarounds exist [1]. Cisco recommends limiting access to the management interface via ACLs or firewall rules where possible, and disabling remote management if not required. These products may be approaching end-of-life; users should assess migration to supported models.