Read the docs
TI-2018-00384 Aliases CVE-2018-0425GHSA-x88p-8c69-vxf4

Cisco RV110W, RV130W, and RV215W Routers Management Interface Information Disclosure Vulnerability

Priority MEDIUM 55CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200 and CWE-269.

Summary

A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper access control to files within the web-based management interface. An attacker could exploit this vulnerability by sending malicious requests to a targeted device. A successful exploit could allow the attacker to gain access to sensitive configuration information, including user authentication credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03413 88th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco RV130W Wireless-N Multifunction VPN Router Firmwareall versions—No fix listedCNA
  • Cisco RV130W Wireless-N Multifunction VPN Router Firmware VendorCisco Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:o:cisco:rv110w_firmware:*:*:*:*:*:*:*:*up to 1.2.1.7VulnerableCisco
cpe:2.3:h:cisco:rv110w_wireless-n_vpn_firewall:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:rv130w_firmware:*:*:*:*:*:*:*:*before 1.0.3.44VulnerableCisco
cpe:2.3:h:cisco:rv130w:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:rv215w_firmware:*:*:*:*:*:*:*:*up to 1.3.0.8VulnerableCisco
cpe:2.3:h:cisco:rv215w_wireless-n_vpn_router:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
  • cpe:2.3:o:cisco:rv110w_firmware:*:*:*:*:*:*:*:* Versions up to 1.2.1.7 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:rv110w_wireless-n_vpn_firewall:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:rv130w_firmware:*:*:*:*:*:*:*:* Versions before 1.0.3.44 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:rv130w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:rv215w_firmware:*:*:*:*:*:*:*:* Versions up to 1.3.0.8 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:rv215w_wireless-n_vpn_router:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-0425
  2. 2026-10-03 Alias added: GHSA-x88p-8c69-vxf4

References

Advisory 1

  • TI-2019-01289 Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-19921 An OS command injection vulnerability exists in the start_lltd() function of the "rc"… CVSS 3.1HIGH 7.2
  • TI-2026-19920 An OS command injection vulnerability exists in the sub_34984() function of the "rc"… CVSS 3.1HIGH 7.2
  • TI-2026-19919 An OS command injection vulnerability exists in the save_syslog_to_file() function of the… CVSS 3.1HIGH 7.2
  • TI-2026-19918 An OS command injection vulnerability exists in the start_bonjour() function of the "rc"… CVSS 3.1HIGH 7.2
  • TI-2021-00894 Stack-based buffer overflow in Cisco Small Business RV Series Router Firmware CVSS 3.1HIGH 7.2
See all 131 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences