CVE-2016-1398 describes a buffer overflow vulnerability in the web-based management interface of several Cisco RV series routers, including the RV110W, RV130W, and RV215W, with specific firmware versions. This flaw allows a remote, authenticated attacker to trigger a denial of service, causing the device to reload, by sending a specially crafted HTTP request. The vulnerability has a CVSSv3 score of 6.5 (Medium), indicating it can be exploited over the network with low attack complexity and requires authentication. The primary impact is high availability, leading to device reloads, but does not compromise confidentiality or integrity. Despite its age, there is no known active exploitation, nor are there public exploit modules available in Metasploit, Nuclei, or ExploitDB. While there is some community discussion and media coverage, including a SecurityWeek article noting the lack of a patch for a related RCE, this specific CVE does not appear to be widely targeted.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.0.0.21CPE matchmatch criteria | cpe:2.3:o:cisco:rv130w_firmware:1.0.0.21:*:*:*:*:*:*:* | ||
1.0.1.3CPE matchmatch criteria | cpe:2.3:o:cisco:rv130w_firmware:1.0.1.3:*:*:*:*:*:*:* | ||
1.0.2.7CPE matchmatch criteria | cpe:2.3:o:cisco:rv130w_firmware:1.0.2.7:*:*:*:*:*:*:* | ||
1.1.0.9CPE matchmatch criteria | cpe:2.3:o:cisco:rv110w_firmware:1.1.0.9:*:*:*:*:*:*:* | ||
1.2.0.9CPE matchmatch criteria | cpe:2.3:o:cisco:rv110w_firmware:1.2.0.9:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.