Cisco Security Advisory: Cisco RV110W, RV130W, and RV215W Routers Static Credential Vulnerability

[Cisco Systems Product Security Incident Response Team <psirt () cisco com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Cisco Security Advisory: Cisco RV110W, RV130W, and RV215W Routers Static Credential Vulnerability

Advisory ID: cisco-sa-20160803-rv110_130w2

Revision 1.0

For Public Release 2016 August 3 16:00 UTC (GMT)

+---------------------------------------------------------------------

Summary
=======

A vulnerability in the default account when used with a specific configuration of the Cisco RV110W Wireless-N VPN 
Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and the Cisco RV215W Wireless-N VPN Router could allow an 
authenticated, remote attacker to gain root access to the device. The account could incorrectly be granted root 
privileges at authentication time.
 
The vulnerability is due to improper role-based access control (RBAC) of the default account. The default account 
should never be allowed root privileges and should, in all cases, be read-only. An attacker could exploit this 
vulnerability by logging into the targeted device using the default account. An exploit could allow the attacker to 
authenticate to the device using the default account and be assigned root privileges.

Cisco has released software updates that address this vulnerability. Workarounds that mitigate this vulnerability are 
not available.

This advisory is available at the following link:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160803-rv110_130w2

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (SunOS)

iQIVAwUBV5jiYa89gD3EAJB5AQJS3RAAoF/cx4RCUPQRg88+uAwjZC0F+tCfQHXF
WvSQo0EZu704fkQsKE7yELdsU8OnAr/HX503ya8bTHTGJaMQkrg6FBw2aS6zDSz6
gaiZLeN9n6krwOPDxIAz0phRNj93WoFUxkA1oOh4Qtp8H9W0cLr7Ggx4jbhBrcrC
Dm6/g/VQREEdMrAiVPO0PKUIEgx8RPY65q2Os5uahRE/3x9uCNJ8FAYVCgTx+1jc
iP+Y1GlYbPH9gmcsEF8cRb/XTM2t08aY4yv7IxRzBK8N2ZnUQBBZDkvJh3ghIycg
efEkhwKdkX3MKig0HsdB6yooFThgOyJLJXOCDIird0t94gulGOxvmGQanF354r58
Dpb1vJfO4yU1N1Ld48RDKwelxV3ArX6WUM24s4ydehpGWHD3qREIbL3T7lQQoy2F
ZZm/ichpQCkfd95wy2NOxGV1cz/gPqlP9LT+00gZP2omk5QdhKA1Xkd9umy/xJhm
YstBja7gYpAA5k3EXjOgIlcq1YPH0PqvqSV55CwxMCzg4mHzkaGbjp2nL6nZ0+gk
NGW7uKcSptqPAA5Y7CAv0h2nG5c1GXRHwZaAmoXXSxIYS5dvIx0SxdmI3QayOIlS
za2HUbv0C1xYwqleJ4euny2RQsX0/C2wv2SLG0q5oJXhh1M8IaS94BMXfad/rgIu
S82N2vOSPfs=
=Ws+u
-----END PGP SIGNATURE-----