All vulnerabilities
CVE-2019-1653

Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability

Cisco Small Business RV320 and RV325 RoutersNetwork & edge
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationExploited in the wildAdded to KEV 3 Nov 2021CISA KEV
Exploit odds (EPSS)99.9%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Federal deadline3 May 2022Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

  1. 9 Sep 2018Exploit code publicMetasploit
  2. 24 Jan 2019, 16:00 UTCPublishedCVE List
  3. 3 Nov 2021Added to CISA KEVCISA KEV

Public exploit code and templates 5

  • Exploit moduleCisco RV320 and RV325 Unauthenticated Remote Code Execution 9 Sep 2018Metasploit
  • Auxiliary moduleCisco RV320/RV326 Configuration Disclosure 24 Jan 2019Metasploit
  • Webapps exploitCisco RV300 / RV320 - Information Disclosure 28 Jan 2019Exploit-DB
  • Remote exploitCisco RV320 and RV325 - Unauthenticated Remote Code Execution (Metasploit) 3 Apr 2019Exploit-DB
  • Scanner templateCisco Small Business WAN VPN Routers - Sensitive Information DisclosureNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers contain improper access controls for URLs. Exploitation could allow an attacker to download the router configuration or detailed diagnostic information.

Text from CVE List

Affected versions 1

  • Cisco Small Business RV Series Router Firmwareaffected: n/aCVE List

References 11