Cisco warns of auth bypass bug with public exploit in EoL routers

Cisco warned customers today of a critical authentication bypass vulnerability with public exploit code affecting multiple end-of-life (EoL) VPN routers.

The security flaw (CVE-2023-20025) was found in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, and RV082 routers by Hou Liuyang of Qihoo 360 Netlab.

It is caused by improper validation of user input within incoming HTTP packets. Unauthenticated attackers can exploit it remotely by sending a specially crafted HTTP request to vulnerable routers' web-based management interface to bypass authentication.

Successful exploitation allows them to gain root access. By chaining it with another vulnerability tracked as CVE-2023-20026 (also disclosed today by Cisco), they can execute arbitrary commands on the underlying operating system.

Despite rating it as a critical severity bug and saying that its Product Security Incident Response Team (PSIRT) team is aware of proof-of-concept exploit code available in the wild, Cisco noted that it "has not and will not release software updates that address this vulnerability."

Luckily, Cisco PSIRT has found no evidence to suggest that the vulnerability is being abused in attacks.

Disable management interface to block attacks

Even though there are no workarounds to address this vulnerability, administrators may disable the vulnerable routers' web-based management interface and block access to ports 443 and 60443 to thwart exploitation attempts.

To do that, you have to log into the web-based management interface of each device, go to Firewall > General, and uncheck the Remote Management check box.

In the security advisory published today, Cisco also provides detailed steps to block access to ports 443 and 60443.

The affected routers will still be accessible and can be configured via the LAN interface after implementing the above mitigation.

In September, the company said it wouldn't fix a critical auth bypass flaw affecting RV110W, RV130, RV130W, and RV215W EoL routers, encouraging them to migrate to RV132W, RV160, or RV160W routers under support.

In June, Cisco again advised owners to switch to newer router models after disclosing a critical remote code execution (RCE) vulnerability (CVE-2022-20825) that was also left unpatched.