Assessment
Why it matters
CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 99.9%; technical severity is CVSS 7.5.
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and requesting specific URLs. A successful exploit could allow the attacker to download the router configuration or detailed diagnostic information. Cisco has released firmware updates that address this vulnerability.
Who should care
- Teams operating Rv320 Firmware, Rv325 Firmware, Small Business RV320 and RV325 Routers
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether Rv320 Firmware, Rv325 Firmware, Small Business RV320 and RV325 Routers is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- Cisco Security advisory Cisco Sa 20190123 Rv Info
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Treatment intelligence
Remediation intelligence
Vendor sources are listed before government and third-party guidance. Confirm product applicability and change prerequisites before deployment.
Advisory
Technical details
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CWE
- CWE-284
- Affected versions
- Cisco Rv320 Firmware (Version 1.4.2.15 | Version 1.4.2.17); Cisco Rv325 Firmware (Version 1.4.2.15 | Version 1.4.2.17); Cisco Small Business RV320 and RV325 Routers
- Fixed versions
- No explicit fixed version is currently recorded.
- Published
- 24 January 2019
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
Signal timeline
- CVE published
- Added to CISA KEV
- Latest EPSS score: 99.9%
- Signal calculated at 83
External references
- CISA Government advisory CVE-2019-1653
- Exploit information from packetstormsecurity.com
- Exploit information from packetstormsecurity.com
- Packetstormsecurity Third-party advisory Cisco RV320 RV325 Unauthenticated Remote Code Execution
- Exploit information from seclists.org
- Exploit information from seclists.org
- Securityfocus Third-party advisory 106732
- Seclists Third-party advisory
- Seclists Third-party advisory
- Threatpost Third-party advisory 141218
- Exploit information from www.exploit-db.com
- Exploit Db Exploit information