CVE-2018-0125
Published: 08 February 2018
Summary
CVE-2018-0125 is a critical-severity Improper Input Validation (CWE-20) vulnerability in Cisco Rv132W Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 3.3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A vulnerability exists in the web interface of the Cisco RV132W ADSL2+ Wireless-N VPN Router and RV134W VDSL2 Wireless-AC VPN Router. It stems from incomplete input validation of user-controlled data in HTTP requests, which permits remote code execution. The flaw is tracked under Cisco Bug IDs CSCvg92737 and CSCvh60170, carries a CVSS score of 9.8, and is also associated with CWE-20.
An unauthenticated remote attacker can exploit the issue by submitting a crafted HTTP request to an affected device. Successful exploitation grants the attacker the ability to run arbitrary commands with root privileges, obtain full control of the system, or trigger a reload that results in a denial-of-service condition.
The vulnerability is addressed in firmware release 1.0.1.11 for both router models, as stated in the Cisco Security Advisory cisco-sa-20180207-rv13x. Organizations should apply the updated firmware to eliminate the exposure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-0948
Vulnerability details
A vulnerability in the web interface of the Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system, including issuing commands…
more
with root privileges. The attacker could also cause an affected system to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to an incomplete input validation on user-controlled input in an HTTP request to the targeted device. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to execute arbitrary code as the root user and gain full control of the affected system or cause it to reload, resulting in a DoS condition. This vulnerability is fixed in firmware version 1.0.1.11 for the following Cisco products: RV132W ADSL2+ Wireless-N VPN Router and RV134W VDSL2 Wireless-AC VPN Router. Cisco Bug IDs: CSCvg92737, CSCvh60170.
- CWE(s)
- KEV Date Added
- 25 March 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all user-controlled HTTP inputs, blocking the crafted requests that exploit the incomplete validation flaw (CWE-20) to achieve RCE.
Mandates prompt application of the vendor-supplied firmware (v1.0.1.11) that eliminates the input-validation defect described in CSCvg92737/CSCvh60170.
Enforces authentication and authorization on the web interface before any request processing, preventing the unauthenticated remote access path used by the exploit.