{"id":"CVE-2019-1652","kind":"vulnerability","aliases":["CVE-2019-1652"],"related":[],"title":"Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers: Cisco Small Business Routers Improper Input Validation Vulnerability","description":"A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux shell as root. Cisco has released firmware updates that address this vulnerability.","summary":"Cisco RV320 and RV325 VPN routers have an input validation flaw in their web management interface that lets a remote attacker run arbitrary commands on the device. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog, so attacks are happening in the wild.","severity":"critical","cvss":9.0,"epss":0.95923,"exploited":true,"exploited_at":"2022-03-03T00:00:00+00:00","products":[{"name":"Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cisco","exploited","infrastructure","rv320","rv325","self-hosted","vpn-router"],"not_affected_if":["management-interface-not-exposed","no-rv320-or-rv325-deployed"],"how_to_check":"Check the router firmware version in the web admin UI (Status or System Summary) or with the router's CLI 'show version'; compare it with the fixed release in Cisco's advisory.","fix":"Apply the Cisco firmware update for RV320/RV325 per the vendor advisory (CISA required action: apply updates per vendor instructions); fixed version not stated in the sources.\nRestrict the web management interface so it is not reachable from the internet.","status":"open","published_at":"2019-01-24T15:29:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:26:16+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:26:16Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Cisco firmware update for RV320/RV325 per the vendor advisory (CISA required action: apply updates per vendor instructions); fixed version not stated in the sources.\nRestrict the web management interface so it is not reachable from the internet.","reach":"internet","impact":"high","summary":"Cisco RV320 and RV325 VPN routers have an input validation flaw in their web management interface that lets a remote attacker run arbitrary commands on the device. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog, so attacks are happening in the wild.","category":"infrastructure","who_cares":["cisco","rv320","rv325","self-hosted","vpn-router"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with admin rights runs arbitrary commands on the router","analyst_note":"Find the fixed firmware versions and exposure details in Cisco's advisory for CVE-2019-1652 (cisco.com security advisories); sources do not name them.","how_to_check":"Check the router firmware version in the web admin UI (Status or System Summary) or with the router's CLI 'show version'; compare it with the fixed release in Cisco's advisory.\nunknown","needs_analyst":true,"not_affected_if":["no-rv320-or-rv325-deployed","management-interface-not-exposed"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000544,"input_tokens":2919,"output_tokens":504,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1652':22A,25A '-2019':21A,24A 'address':190C 'administr':121C 'affect':125C,164C 'allow':115C,170C 'and':30A 'arbitrari':70B,129C,175C 'attack':68B,87B,119C,144C,172C 'authent':117C 'base':99C,159C 'busi':3A,14A,105C 'business':28A 'catalog':85B 'cisa':80B 'cisco':1A,12A,26A,37B,48B,103C,184C 'command':71B,130C,176C 'could':114C,145C,169C 'cve':20A,23A 'devic':74B,126C,165C 'dual':7A,32A,109C 'due':134C 'execut':128C,174C 'exploit':38B,83B,146C,168C 'firmwar':187C 'flaw':58B,76B 'gigabit':8A,33A,110C 'happen':89B 'host':44B 'http':152C 'improp':16A,136C 'infrastructur':39B 'input':17A,56B,142C 'interfac':63B,101C,161C 'known':82B 'let':65B 'linux':180C 'list':78B 'malici':151C 'manag':62B,100C,160C 'post':153C 'privileg':122C 'releas':186C 'remot':67B,118C 'request':154C 'root':183C 'router':11A,15A,47B,53B,113C 'routers':36A 'run':69B 'rv320':4A,29A,40B,49B,106C 'rv325':6A,31A,41B,51B,108C 'self':43B 'self-host':42B 'send':150C 'shell':181C 'small':2A,13A,27A,104C 'success':167C 'suppli':141C 'under':179C 'updat':188C 'user':140C 'user-suppli':139C 'valid':18A,57B,137C 'vpn':10A,35A,46B,52B,112C 'vpn-router':45B 'vulner':19A,84B,94C,132C,148C,192C 'wan':9A,34A,111C 'web':61B,98C,158C 'web-bas':97C,157C 'wild':92B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-01-24T15:29:00+00:00","kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-1652","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1652","severity":null,"published_at":"2022-03-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:07+00:00","note":null},{"source":"epss","external_id":"CVE-2019-1652","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1652","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-1652","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1652","severity":null,"published_at":"2019-01-24T15:29:00+00:00","modified_at":"2026-06-17T02:28:57+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}