Cisco is advising owners of Small Business RV routers at the end of their life cycle to upgrade to newer models after discovering a remote code execution (RCE) vulnerability that will not be patched.
See also: QNAP to customers: Disable UPnP Port Forwarding on routers
The vulnerability is tracked as CVE-2022-20825 and has a CVSS severity rating of 9.8 out of 10.0.
According to a Cisco security advisory, the flaw exists due to insufficient user input validation of incoming HTTP packets on affected devices.
An attacker could exploit this by sending a specially crafted request to the web-based management interface, resulting in the execution of commands with root-level privileges.
See also: ASUS: Cyclops Blink malware targets company's routers
Impact and recovery
The vulnerability affects four models in the Small Business RV series, namely the RV110W Wireless-N VPN Firewall, the RV130 VPN Router, the RV130W Wireless-N Multifunction VPN Router, and the RV215W Wireless-N VPN Router.
This vulnerability only affects devices with the web-based remote management interface enabled over WAN connections.
While remote management is not enabled in the default configuration, brief searches using Shodan identified exposed devices.
To determine whether remote management is enabled, administrators should log in to the web-based management interface, go to “Basic Settings > Remote Management,” and verify the status of the relevant checkbox.
See also: Microsoft creates tool to scan MikroTik routers for TrickBot infections
Cisco states that it will not be releasing a security update for CVE-2022-20825, as the devices are no longer supported . Additionally, there are no mitigations available other than disabling remote management on the WAN interface, which should be done independently for better overall security.
Users are advised to apply the configuration changes until they migrate to Cisco Small Business RV132W, RV160, or RV160W routers, which are actively supported by the vendor.
Cisco warned last year that administrators should upgrade to newer models after revealing that they would not patch a critical vulnerability in the Universal Plug-and-Play (UPnP) service.
This week, Cisco is patching a critical vulnerability in Cisco Secure Email that could allow attackers to bypass authentication and log in to the web management interface of the Cisco email gateway.
Information source: bleepingcomputer.com
