English (United States)

Cisco has announced a total of four vulnerabilities in the web management interface of three wireless routers (models RV110W, RV130W and RV215W). At least one of the problems could allow taking control of the affected devices

 The most serious problem (with  CVE-2016-1395 ) lies in inadequate filtering of the user's http entries, which could allow a remote attacker without authenticating to execute arbitrary code with root privileges on the affected system.

A  second problem , with CVE-2016-1396, lies in the inadequate validation of certain parameters sent to the affected devices through HTTP GET or HTTP POST methods. This error could allow an unauthenticated remote attacker to build cross-site scripting attacks.

Finally, two buffer overflow vulnerabilities (CVE-2016-1397 and CVE-2016-1398) result from improper filtering of user input from fields in http requests that are sent when a user configures an affected device via the web interface. of administration. An unauthenticated remote attacker could cause denial of service conditions.

All issues affect the following products:

  • RV110W Wireless-N VPN Firewall.
  • RV130W Wireless-N Multifunction VPN Router.
  • RV215W Wireless-N VPN Router.

 

 

 

Cisco will release firmware updates in the third quarter of this year. The updates are expected to be:

  • For Cisco RV110W Wireless-N VPN Firewall, version 1.2.1.7.
  • For Cisco RV130W Wireless-N Multifunction VPN Router, version 1.0.3.16.
  • For Cisco RV215W Wireless-N VPN Router, version 1.3.0.8.

They will be available for download from

http://www.cisco.com/cisco/software/navigator.html.

On Products > Routers > Small Business Routers > Small Business RV Series Routers

 

More information:

Cisco RV110W, RV130W, and RV215W Routers Arbitrary Code Execution Vulnerability

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160615-rv

Cisco RV110W, RV130W, and RV215W Routers Cross-Site Scripting Vulnerability

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160615-rv1

 

Cisco RV110W, RV130W, and RV215W Routers HTTP Request Buffer Overflow Vulnerability

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160615-rv2.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160615-rv3 .