---
id: "CVE-2019-1652"
kind: "vulnerability"
aliases: ["CVE-2019-1652"]
title: "Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers: Cisco Small Business Routers Improper Input Validation Vulnerability"
severity: "critical"
cvss: 9.0
epss: 0.95923
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cisco", "exploited", "infrastructure", "rv320", "rv325", "self-hosted", "vpn-router"]
not_affected_if: ["management-interface-not-exposed", "no-rv320-or-rv325-deployed"]
published_at: "2019-01-24T15:29:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1652", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-1652", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1652", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers: Cisco Small Business Routers Improper Input Validation Vulnerability

Cisco RV320 and RV325 VPN routers have an input validation flaw in their web management interface that lets a remote attacker run arbitrary commands on the device. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog, so attacks are happening in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers affected ? fixed ?

## How to check

Check the router firmware version in the web admin UI (Status or System Summary) or with the router's CLI 'show version'; compare it with the fixed release in Cisco's advisory.

## Fix

Apply the Cisco firmware update for RV320/RV325 per the vendor advisory (CISA required action: apply updates per vendor instructions); fixed version not stated in the sources.
Restrict the web management interface so it is not reachable from the internet.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1652
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-1652
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-1652

## From the sources

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux shell as root. Cisco has released firmware updates that address this vulnerability.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_