PT-2018-2283 · Cisco · Cisco Small Business Routers

Philip Huppert · Published 2018-09-19 · Updated 2025-02-24 · CVE-2019-1652

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers (affected versions not specified)

Description A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux shell as root.

Recommendations For Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers, update to the latest firmware version to address this vulnerability. As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation. Avoid using the web-based management interface until the issue is resolved.

Exploit

Fix

OS Command Injection

RCE

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

BDU:2019-00407

CVE-2019-1652

Affected Products

Cisco Small Business Routers

References · 19

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/cisco_rv32x_rce.rb · Exploit
• 🔥 https://github.com/0x27/CiscoRV320Dump · Exploit
• 🔥 http://packetstormsecurity.com/files/152262/Cisco-RV320-Command-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/46655 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2019/Mar/61 · Exploit
• 🔥 https://seclists.org/bugtraq/2019/Mar/55 · Exploit
• 🔥 https://exploit-db.com/exploits/46243 · Exploit
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-inject · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00407 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1652 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1652 · Security Note
• https://twitter.com/ravirockks/status/1745598040487112919 · Twitter Post
• https://t.me/true_secator/3042 · Telegram Post
• https://t.me/cvenotify/112260 · Telegram Post
• http://securityfocus.com/bid/106728 · Note