Multiple vulnerabilities in Cisco RV110W, RV130W, and RV215W routers

Published: 2016-06-15 | Updated: 2019-03-01

Risk	High
Patch available	YES
Number of vulnerabilities	4
CVE-ID	CVE-2016-1397 CVE-2016-1398 CVE-2016-1396 CVE-2016-1395
CWE-ID	CWE-119 CWE-79 CWE-20
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	RV130W Wireless-N Multifunction VPN Router Hardware solutions / Routers for home users RV110W Wireless-N VPN Firewall Hardware solutions / Routers for home users RV215W Wireless-N VPN Router Hardware solutions / Routers for home users
Vendor	Cisco Systems, Inc

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

UPDATED: 01.03.2019

Added additional links to all vulnerabilities, changed description, CVSS and software version sections.

1) Buffer overflow

EUVDB-ID: #VU10

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-1397

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

A vulnerability in the web-based management interface of Cisco RV110W Wireless-N VPN Firewalls, Cisco RV130W Wireless-N Multifunction VPN Routers, and Cisco RV215W Wireless-N VPN Routers could allow an authenticated, remote attacker to cause a buffer overflow on a targeted system, resulting in a denial of service (DoS) condition.

An attacker can exploit this vulnerability by sending an HTTP request that contains configuration commands with a crafted payload.

Mitigation

Install updated from vendor's website.

Vulnerable software versions

RV130W Wireless-N Multifunction VPN Router: 1.0.0.21 - 1.0.3.15

RV110W Wireless-N VPN Firewall: 1.0.0.2 - 1.2.1.6

RV215W Wireless-N VPN Router: 1.1.0.5 - 1.3.0.7

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160615-rv2
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCux82523
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCux82531
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCux82536

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU9

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-1398

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

An attacker can exploit this vulnerability by sending an HTTP request that contains configuration commands with a crafted payload.

Mitigation

Install updated from vendor's website.

Vulnerable software versions

RV110W Wireless-N VPN Firewall: 1.0.0.2 - 1.2.1.6

RV130W Wireless-N Multifunction VPN Router: 1.0.0.21 - 1.0.3.15

RV215W Wireless-N VPN Router: 1.1.0.5 - 1.3.0.7

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160615-rv3
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCux86664
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCux86675
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCux86669

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Cross-site scripting

EUVDB-ID: #VU8

Risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-1396

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

A vulnerability in the web-based management interface of Cisco RV110W Wireless-N VPN Firewalls, Cisco RV130W Wireless-N Multifunction VPN Routers, and Cisco RV215W Wireless-N VPN Routers could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface for a targeted device.

A successful exploit can allow the attacker to execute arbitrary script in the context of the web-based management interface for the device or allow the attacker to access sensitive browser-based information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

RV110W Wireless-N VPN Firewall: 1.0.0.2 - 1.2.1.6

RV130W Wireless-N Multifunction VPN Router: 1.0.0.21 - 1.0.3.15

RV215W Wireless-N VPN Router: 1.1.0.5 - 1.3.0.7

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160615-rv1
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCux82567
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCux82583
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCux82599

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper input validation

EUVDB-ID: #VU7

Risk: High

CVSSv3.1: 8.3 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-1395

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation when processing HTTP request in web management interface. A remote unauthenticated attacker can send a specially crafted HTTP request to the affected device and execute arbitrary code on the target device with root privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

RV215W Wireless-N VPN Router: 1.1.0.5 - 1.3.0.7

RV130W Wireless-N Multifunction VPN Router: 1.0.0.21 - 1.0.3.15

RV110W Wireless-N VPN Firewall: 1.0.0.2 - 1.2.1.6

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160615-rv
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCux82416
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCux82422
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCux82428

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.