CVE-2019-1652
Cisco Small Business Routers Improper Input Validation Vulnerability
Description
CVE-2019-1652 is a high-severity improper input validation vulnerability affecting Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers. A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 92.36% (99.7th percentile), this vulnerability has a notable probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | rv320 firmware | >= 1.4.2.15, < 1.4.2.22 |
| cisco | rv325 firmware | >= 1.4.2.15, < 1.4.2.22 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/152262/Cisco-RV320-Command-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/152305/Cisco-RV320-RV325-Unauthenticated-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- http://seclists.org/fulldisclosure/2019/Mar/61(Exploit, Mailing List, Third Party Advisory)
- http://www.securityfocus.com/bid/106728(Third Party Advisory, VDB Entry)
- https://seclists.org/bugtraq/2019/Mar/55(Exploit, Mailing List, Third Party Advisory)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-inject(Vendor Advisory)
- https://www.exploit-db.com/exploits/46243/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/46655/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1652(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
Improper Input Validation is a software weakness where a product receives input or data but does not validate or incorrectly validates that the input has the properties required to process data safely and correctly. This vulnerability occurs when applications accept user-supplied data without verifying that it conforms to expected formats, lengths, types, or ranges. Additionally, this vulnerability involves CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')), which os command injection is a vulnerability that occurs when software constructs all or part of an operating system command using externally-influenced input from an upstream component, but does not neutralize or incorrectly neutralizes special elements that could modify the intended os command.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2019-1652 carries a CVSS 3.1 score of 7.2 (HIGH), indicating a high-severity threat. The vulnerability is exploitable over the network with low attack complexity and requires administrative privileges. Successful exploitation can severely compromise data confidentiality, and allow unauthorized modification of data and systems, and cause complete service disruption. Organizations running affected Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers deployments face significant operational risk if this vulnerability remains unpatched.
Exploit Maturity
CVE-2019-1652 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 92.36% (99.7th percentile) reflects an exceptionally high probability of exploitation. Public exploit code is available, which lowers the barrier for attackers and increases the urgency of remediation. Federal agencies were required to remediate this vulnerability by 2022-03-17 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions.
- Verify that all instances of affected products (cisco rv320 firmware >= 1.4.2.15, < 1.4.2.22; cisco rv325 firmware >= 1.4.2.15, < 1.4.2.22) have been updated to patched versions.
- If immediate patching is not possible, restrict network access to affected systems using firewall rules and network segmentation to limit exposure.
- Monitor systems for indicators of compromise, including unusual process activity, unexpected network connections, and unauthorized configuration changes.
- Review security logs and conduct threat hunting to determine if the vulnerability was exploited prior to patching.
Technical Details
CVE-2019-1652 affects Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers. A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The attack vector is network-based, meaning an attacker can exploit this vulnerability remotely without physical access to the target system. The CVSS score of 7.2 reflects a serious vulnerability that poses meaningful risk to affected environments.
Frequently Asked Questions
Is CVE-2019-1652 being actively exploited?
Yes. CVE-2019-1652 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 92.36% (99.7th percentile) further indicates a very high exploitation probability.
What products are affected by CVE-2019-1652?
CVE-2019-1652 affects Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers. Specifically affected products include: cisco rv320 firmware (>= 1.4.2.15, < 1.4.2.22), cisco rv325 firmware (>= 1.4.2.15, < 1.4.2.22).
How do I fix CVE-2019-1652?
Apply updates per vendor instructions. Ensure all affected systems are updated to the latest patched versions. If patching is not immediately possible, implement network-level mitigations to limit exposure.
How severe is CVE-2019-1652?
CVE-2019-1652 has a CVSS 3.1 score of 7.2 (HIGH). This is a high-severity vulnerability that should be prioritized for remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.