CVE-2020-3144: Cisco RV110W, RV130, RV130W, and RV215W Routers Authentication Bypass Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-07-16 · updated 2026-06-17
Weakness: CWE-284

Description

A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, RV130 VPN Router, RV130W Wireless-N Multifunction VPN Router, and RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary commands with administrative commands on an affected device. The vulnerability is due to improper session management on affected devices. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to gain administrative access on the affected device.

Affected products

Cisco Rv110W Firmware: before 1.2.2.8 — fixed in 1.2.2.8
Cisco Rv130 Firmware: before 1.0.3.55 — fixed in 1.0.3.55
Cisco Rv130W Firmware: before 1.0.3.55 — fixed in 1.0.3.55
Cisco Rv215W Firmware: before 1.3.1.7 — fixed in 1.3.1.7

How to fix

Upgrade to a fixed version: Cisco Rv110W Firmware 1.2.2.8; Cisco Rv130 Firmware 1.0.3.55; Cisco Rv130W Firmware 1.0.3.55; Cisco Rv215W Firmware 1.3.1.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-3144 or the next vulnerability affects your stack