CVE-2021-1167
📋 TL;DR
This CVE describes multiple input validation vulnerabilities in Cisco Small Business RV series routers' web management interface. Authenticated attackers can execute arbitrary code as root or cause denial of service via crafted HTTP requests. Affected devices include RV110W, RV130, RV130W, and RV215W routers.
💻 Affected Systems
- Cisco RV110W
- Cisco RV130
- Cisco RV130W
- Cisco RV215W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise with root-level arbitrary code execution, allowing attacker persistence, data theft, and use as pivot point in network.
Likely Case
Denial of service through device reboot, disrupting network connectivity for connected users and services.
If Mitigated
Limited to authenticated administrators only, reducing attack surface significantly with proper credential management.
🎯 Exploit Status
Exploitation requires administrator credentials but uses simple HTTP requests; public PoC exists for DoS variant
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-overflow-WUnUgv4U
Restart Required: No
Instructions:
No official patch available. Cisco recommends upgrading to newer hardware models as these devices have reached end-of-life.
🔧 Temporary Workarounds
Disable Web Management Interface
allDisable the vulnerable web-based management interface to prevent exploitation
Access router CLI via SSH/Telnet
configure terminal
no ip http server
no ip http secure-server
end
write memory
Restrict Management Access
allLimit web management interface access to specific trusted IP addresses only
configure terminal
ip http access-class [ACL-NAME]
ip http secure-server access-class [ACL-NAME]
end
write memory
🧯 If You Can't Patch
- Replace affected routers with newer supported models (RV160, RV260, or later)
- Implement network segmentation to isolate routers from critical assets
🔍 How to Verify
Check if Vulnerable:
Check router model and firmware version via web interface or CLI command 'show version'Check Version:
show versionVerify Fix Applied:
Verify web interface is disabled: 'show running-config | include http' should show no http server lines📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts followed by successful login
- Unusual HTTP POST requests to management interface
- Device reboot logs without scheduled maintenance
Network Indicators:
- HTTP traffic to router management interface from unexpected sources
- Sudden increase in management interface traffic
SIEM Query:
source="router_logs" (http AND (admin OR login) AND success) AND (POST OR reboot)🔗 References
- http://packetstormsecurity.com/files/160953/Cisco-RV110W-1.2.1.7-Denial-Of-Service.html
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-overflow-WUnUgv4U
- http://packetstormsecurity.com/files/160953/Cisco-RV110W-1.2.1.7-Denial-Of-Service.html
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-overflow-WUnUgv4U
