ZeroDay Findings
Sign inSign up

Findings

CVE-2019-1652

Cisco Small Business Routers Improper Input Validation Vulnerability

Published Jan 24, 2019 · updated Jun 16, 2026 · cisco rv320 firmware

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux shell as root. Cisco has released firmware updates that address this vulnerability.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 24, 2019 · Catalog

    Detected

    A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST

  2. Mar 3, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Mar 17, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST

Required action

Apply updates per vendor instructions.

CISA due date Mar 17, 2022

Affected

  • cpe cisco/rv320 firmwareversion unspecified
  • cpe cisco/rv325 firmwareversion unspecified
  • vendor Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routersversion unspecified

Sources

  • CISA KEVCVE-2019-1652

    A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands.

    cisa.gov
  • CVE.orgCVE-2019-1652

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2019-1652

    30-day exploitation probability 95.9%

    first.org
  • Exploit Database46243

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database46655

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_linux/http/cisco_rv32x_rce

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2019-1652

    A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/152262/Cisco-RV320-Command-Injection.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com
  • Packet Storm Securityhttp://packetstormsecurity.com/files/152305/Cisco-RV320-RV325-Unauthenticated-Remote-Code-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References

CVE-2019-1652 · ZeroDay Findings