SECUFOCUSNOW
Home›CVE index›CVE-2019-1652
CISA KEV · Known exploitedHigh

CVE-2019-1652

Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux shell as root. Cisco has r...

CVSS
7.2
EPSS
95.9%
99.9% percentile
CISA KEV
Listed
Published
2019.01.25
PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV
Exploit probability95.9%
Technical severityCVSS 7.2

Vulnerability overview

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux shell as root. Cisco has r...

Affected product and versions

Product
Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers
Affected versions
>= 1.4.2.15 < 1.4.2.22
Fixed versions
1.4.2.22

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
CISA required action

Apply updates per vendor instructions.

Due date: 2022.03.17
  1. 1
    Identify

    Confirm that Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-20, CWE-78
KEV added
2022.03.03
Ransomware use
미확인