Cisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting Vulnerabilities

Vulnerability

The vulnerabilities reside in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 routers. They are due to insufficient input validation, allowing an unauthenticated, remote attacker to inject malicious script. No authentication is required to trigger the vulnerability, but user interaction is needed for the XSS to execute.

Exploitation

An attacker can exploit these vulnerabilities by sending crafted HTTP requests to an affected device. The attacker must then persuade a user (e.g., an administrator) to visit specific web pages that include the malicious payloads. The user must be logged into the management interface for the script to execute in that context.

Impact

Successful exploitation allows the attacker to execute arbitrary script code in the context of the affected interface. This could lead to access to sensitive browser-based information, such as session tokens or cookies, and potentially allow the attacker to perform actions as the victim user.

Mitigation

Cisco has not released software updates that address these vulnerabilities. No workarounds are available. As a mitigation, disable remote management on all affected devices. For RV016, RV042, RV042G, and RV082 routers, additionally block access to ports 443 and 60443 from the WAN. Detailed steps are provided in the Cisco Security Advisory [1]. The routers remain accessible via the LAN interface after mitigation.