Cisco released a security advisory on a critical code execution vulnerability affecting its small business RV110W, RV130, RV130W, and RV215W routers, but cautioned that there are no plans to release security fixes.
The advisory states that the vulnerability found in the Universal Plug-and-Play (UPnP) service of Cisco Small Business, could allow an unauthenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly, resulting in a denial of service (DoS) condition.
This vulnerability is tracked as CVE-2021-34730 with a CVSS score of 9.8 is due to improper validation of incoming UPnP traffic. An attacker could exploit this vulnerability by sending a crafted UPnP request to an affected device.
The vulnerability was reported by Quentin Kaiser of IoT Inspector Research Lab.
Cisco noted that a successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a DoS condition.
- RV110W Wireless-N VPN Firewalls
- RV130 VPN Routers
- RV130W Wireless-N Multifunction VPN Routers
- RV215W Wireless-N VPN Router
Owners of RV110W Wireless-N VPN Firewalls, RV130 VPN Routers, RV130W Wireless-N Multifunction VPN Routers, and RV215W Wireless-N VPN Routers are advised to disable UPnP on both the LAN and WAN interfaces of their devices, to mitigate the bug. UPnP is enabled by default on LAN interfaces.
“While this mitigation has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their environment and under their use conditions,” Cisco notes
Cisco declares that it has not released and will not release software updates to address the vulnerability, since it affects older products that have already reached end-of-life (EOL) status.
Customers should be conscious that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations.
Cisco advises customers to frequently check with the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution.
Customers also should make sure that new devices will be sufficient for their network needs; the new devices contain sufficient memory, and current hardware and software configurations will continue to be supported properly by the new product.