{"schema":"threatline.record/2","record":{"id":"CVE-2019-1653","aliases":[],"summary":"Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability","details":"Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers contain improper access controls for URLs. Exploitation could allow an attacker to download the router configuration or detailed diagnostic information.","categories":["Network & edge"],"product":"Small Business RV320 and RV325 Routers","vendor":"Cisco","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2019-1653","source_modified_at":"2025-10-21T23:45:43.980Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Cisco Small Business RV Series Router Firmware","vendor":"Cisco","versions":[{"status":"affected","version":"n/a"}],"defaultStatus":null}],"fixed_versions":[],"cvss":7.5,"severity":"High","kev":{"listed":true,"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","ransomware_campaign_use":"Unknown"},"epss":{"probability":0.99876,"percentile":0.99964,"score_date":"2026-10-23"},"published_at":"2019-01-24T16:00:00.000Z","modified_at":"2025-10-21T23:45:43.980Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2019-1653","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2025-10-21T23:45:43.980Z"},{"source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/cisco_rv32x_rce.rb","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2018-09-09"},{"source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/cisco_rv320_config.rb","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2019-01-24"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/46262","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2019-01-28"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/46655","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2019-04-03"},{"source":"Nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-1653.yaml","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":null},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1653","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","Metasploit","Exploit-DB","Nuclei","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1653","source":"CISA KEV"},{"source":"CVE List","url":"https://www.youtube.com/watch?v=bx0RQJDlGbY","tags":["x_refsource_MISC","x_transferred"]},{"source":"CVE List","url":"https://badpackets.net/over-9000-cisco-rv320-rv325-routers-vulnerable-to-cve-2019-1653/","tags":["x_refsource_MISC","x_transferred"]},{"source":"CVE List","url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info","tags":["vendor-advisory","x_refsource_CISCO","x_transferred"]},{"source":"CVE List","url":"https://www.exploit-db.com/exploits/46262/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"source":"CVE List","url":"https://seclists.org/bugtraq/2019/Mar/54","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"source":"CVE List","url":"https://seclists.org/bugtraq/2019/Mar/53","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"source":"CVE List","url":"https://www.exploit-db.com/exploits/46655/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"source":"CVE List","url":"https://www.zdnet.com/article/hackers-are-going-after-cisco-rv320rv325-routers-using-a-new-exploit/","tags":["x_refsource_MISC","x_transferred"]},{"source":"CVE List","url":"https://threatpost.com/scans-cisco-routers-code-execution/141218/","tags":["x_refsource_MISC","x_transferred"]},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1653","tags":["government-resource"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"active","automatable":"yes","technical_impact":"partial","assessed_at":"2024-11-08T17:20:12.536408Z"},"exploits":[{"source":"Metasploit","kind":"Exploit module","name":"Cisco RV320 and RV325 Unauthenticated Remote Code Execution","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/cisco_rv32x_rce.rb","date":"2018-09-09","added":"2026-04-22","check":true},{"source":"Metasploit","kind":"Auxiliary module","name":"Cisco RV320/RV326 Configuration Disclosure","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/cisco_rv320_config.rb","date":"2019-01-24","added":"2025-06-23","check":false},{"source":"Exploit-DB","kind":"Webapps exploit","name":"Cisco RV300 / RV320 - Information Disclosure","url":"https://www.exploit-db.com/exploits/46262","date":"2019-01-28","added":"2019-01-28","verified":false},{"source":"Exploit-DB","kind":"Remote exploit","name":"Cisco RV320 and RV325 - Unauthenticated Remote Code Execution (Metasploit)","url":"https://www.exploit-db.com/exploits/46655","date":"2019-04-03","added":"2019-04-03","verified":true},{"source":"Nuclei","kind":"Scanner template","name":"Cisco Small Business WAN VPN Routers - Sensitive Information Disclosure","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-1653.yaml"}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2025-10-21T23:45:43.980Z","content_hash":"22c6f7deda5eb38a137058245a621dda5feb3929c2ebcbd0a3e32bc0e6972905"}}