Two new vulnerabilities have been disclosed on end-of-life Cisco RV Series small business routers. These vulnerabilities can be exploited individually or chained into an attack that allows for remote attackers to gain root access to the operating system where they can then execute arbitrary code. The affected devices are RV016 Multi-WAN VPN Routers, RV042 Dual WAN VPN Routers, RV042G Dual Gigabit WAN VPN Routers, and RV082 Dual WAN VPN Routers. No software update has been provided by Cisco, as these are all end-of-life products, so are no longer supported by the supplier.   

Proof-of-concept code is believed to be available for exploits of these vulnerabilities, however the Product Security Incident Response Team (PSIRT) at Cisco have stated that they are “not aware of any malicious use of the vulnerabilities”. The critical severity flaw with a CVSS rating of 9.0 is tracked as CVE-2023-20025. This vulnerability is caused by improper validation of user input in incoming HTTP packets. An unauthenticated attacker could exploit this by crafting an HTTP request and sending it to the web-based management interface that causes a bypass of the authentication system and provides the remote attacker with root access. This attack can be joined with an exploit of CVE-2023-20026 which is a medium severity remote code execution vulnerability. Before an exploit of this flaw can take place, the attacker needs administrators’ credentials. However, access to the root from the previous exploit allows for arbitrary commands to be executed directly on the operating system.  

As these vulnerabilities will not be receiving a security patch, all affected products are vulnerable to attack. Researchers at Censys discovered that over 19,000 Cisco devices are currently exposed to the internet due to CVE-2023-20025. No workarounds exist for either of these flaws, however disabling the web-based management interface, where an exploit would otherwise occur, can help mitigate the threat. This can be done through the Firewall settings, in the General section, where the Remote Management box needs to be unticked. Cisco also advise blocking access to ports 443 and 60443 on any devices that are continuing to be used, which can be done through changing the Firewall Access Rules.