7.5
High
Exploited
CVE-2019-1653 Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Not observed so far
Weakness
CWE-284
Description
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and requesting specific URLs. A successful exploit could allow the attacker to download the router configuration or detailed diagnostic information. Cisco has released firmware updates that address this vulnerability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cisco Small Business RV Series Router Firmware | Versions not published |
References
- www.youtube.com www.youtube.com
- badpackets.net badpackets.net
- 20190123 Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability tools.cisco.com
- 106732 www.securityfocus.com
- 46262 www.exploit-db.com
- 20190327 [RT-SA-2019-004] Cisco RV320 Unauthenticated Diagnostic Data Retrieval seclists.org
- 20190327 [RT-SA-2019-003] Cisco RV320 Unauthenticated Configuration Export seclists.org
- 20190327 [RT-SA-2019-004] Cisco RV320 Unauthenticated Diagnostic Data Retrieval seclists.org
- 20190327 [RT-SA-2019-003] Cisco RV320 Unauthenticated Configuration Export seclists.org
- packetstormsecurity.com packetstormsecurity.com
- packetstormsecurity.com packetstormsecurity.com
- packetstormsecurity.com packetstormsecurity.com
- 46655 www.exploit-db.com
- www.zdnet.com www.zdnet.com
- threatpost.com threatpost.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of Cisco Small Business RV Series Router Firmware
The 262 CVEs of Cisco Small Business RV Series Router Firmware →
CVE-2020-3431
A vulnerability in the web-based management interface of Cisco Small Business RV042 Dual WAN VPN Routers and…
6.1
Medium
CVE-2024-20524
A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers…
6.8
Medium
CVE-2024-20523
A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers…
6.8
Medium
CVE-2024-20522
A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers…
6.5
Medium