peter bassill · operator
$ cve CVE-2019-1652 JSON

CVE-2019-1652 KEV EXPLOIT

7.2
HIGH · CVSS 3.1 · EPSS 95.9% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-03-17.

Description

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux shell as root. Cisco has released firmware updates that address this vulnerability.

Scoring

CVSS7.2 (HIGH, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS95.92% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-20
On CISA KEVyes — remediate by 2022-03-17
Public exploityes
Published2019-01-24
Last modified2026-06-17

CISA KEV

NameCisco Small Business Routers Improper Input Validation Vulnerability
Added2022-03-03
Due2022-03-17
Vendor / productCisco / Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers
Ransomware usenone reported

Affected (4)

VendorProduct
ciscorv320
ciscorv320 firmware
ciscorv325
ciscorv325 firmware

Public exploits

SourceTitleDate
exploit-dbCisco RV320 and RV325 - Unauthenticated Remote Code Execution (Metasploit)2019-04-03
exploit-dbCisco RV320 Dual Gigabit WAN VPN Router 1.4.2.15 - Command Injection2019-01-25

References

→ the Explorer  ·  watch your stack  ·  NVD