Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
Cisco · RV110W Wireless-N VPN Firewall
The flaw is improper validation of user-supplied data in the web-based management interface of the Cisco RV110W, RV130W, and RV215W Wireless-N VPN routers and firewalls. An unauthenticated remote attacker who sends malicious HTTP requests to the management interface can execute arbitrary code on the underlying operating system as a high-privilege user, with no user interaction required.
A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The vulnerability is due to improper validation of user-supplied data in the web-based management interface. An attacker could exploit this vulnerability by sending malicious HTTP requests to a targeted device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system of the affected device as a high-privilege user. RV110W Wireless-N VPN Firewall versions prior to 1.2.2.1 are affected. RV130W Wireless-N Multifunction VPN Router versions prior to 1.0.3.45 are affected. RV215W Wireless-N VPN Router versions prior to 1.3.1.1 are affected.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 1 day after disclosure. Public exploit code (Metasploit) was available 1 day before disclosure.
- Public exploit codeMetasploit1 day before
- Disclosedday 0
- First seen exploitedVulnCheck KEV evidence+1 day
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Not named in any threat report yetAlso mentioned in 6 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- RondoDox | Guest System attacking | EuroTarget16 Jan 2026
- From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits15 Oct 2025
- From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits14 Oct 2025
- RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits.10 Oct 2025
- From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits10 Oct 2025
- UPX executable packer.9 May 2024