CVE-2018-0127: Cisco RV132W and RV134W router web interface missing authentication exposes admin password

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required and direct disclosure of the administrator password, though no KEV listing or documented exploit exists.

What it is

The web interface of Cisco RV132W and RV134W VPN routers fails to require authentication for certain pages that hold device configuration data. An unauthenticated remote attacker can request those pages and read configuration parameters, including the administrator password. This is a missing-authentication information exposure flaw in internet-facing small-business routers.

Impact

An attacker gains read access to device configuration, including the administrator password, enabling full administrative takeover of the router and any traffic or VPN credentials it handles.

Attack surface

Reachable over the network through the router web interface via a crafted HTTP request; no authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV and no public exploit or ransomware use is documented in the record, but EPSS is very high (0.775, 99.5th percentile), indicating strong likelihood of exploitation activity.

What to do

• Apply the Cisco firmware fix for RV132W and RV134W per the vendor advisory cisco-sa-20180207-rv13x_2.
• Disable remote management of the web interface and restrict administrative access to trusted internal networks.
• Change the administrator password after patching, since it may already have been disclosed.
• Place affected routers behind a firewall or VPN and block inbound HTTP/HTTPS to the management interface from the internet.
• Replace end-of-support units that no longer receive firmware updates.

Detection

• Monitor router and perimeter logs for unauthenticated HTTP requests to configuration or password pages on RV132W/RV134W management interfaces.
• Alert on inbound connections to the router web interface from external or unexpected source addresses.
• Audit router configuration and admin credentials for signs of unauthorized change or reuse.
• Track vendor advisories and asset inventory for unpatched RV132W/RV134W devices.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.