CVE-2018-0125: Cisco RV132W/RV134W routers unauthenticated remote code execution via HTTP input validation flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution as root with a CVSS of 9.8 and confirmed exploitation in CISA KEV makes this an urgent patching priority.

What it is

The web interface of Cisco RV132W and RV134W VPN routers fails to properly validate user-controlled input in HTTP requests, allowing crafted requests to reach vulnerable code paths. A remote, unauthenticated attacker can exploit this to run arbitrary code as root or force the device to reload. Because the flaw is reachable without credentials and yields root-level control, it is a severe risk to any exposed router.

Impact

An attacker gains full control of the affected router, including the ability to issue commands with root privileges, and can alternatively crash or reload the device to cause a denial of service.

Attack surface

The flaw is reached over the network through the device web interface via a crafted HTTP request. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

CVE-2018-0125 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-25), indicating exploitation in the wild, and EPSS gives a 30-day probability of roughly 0.55 (98.9th percentile). No ransomware campaign use is documented in the record.

What to do

• Upgrade RV132W and RV134W firmware to version 1.0.1.11 or later as directed by Cisco.
• Remove or restrict internet-facing management access to the router web interface; place management behind a VPN or trusted network.
• Disable remote management/HTTP access from untrusted networks where the feature is not required.
• Monitor vendor advisories and CISA KEV guidance for this CVE and apply the required action.
• If patching is not immediately possible, isolate affected routers on segmented networks and limit reachable services.

Detection

• Inspect HTTP request logs and network traffic to the router web interface for malformed or unusually long input parameters.
• Alert on unexpected device reloads or reboots that could indicate a DoS attempt.
• Monitor for anomalous outbound connections or command execution behavior originating from the router.
• Check firmware versions of RV132W/RV134W devices against the fixed 1.0.1.11 release.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.