Log in Start free

Actively exploited · Published Jan 24, 2019 · Assigned by cisco

CVE-2019-1653Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability

High 7.5 Exploited

In plain English

A high-severity improper access control in Cisco Small Business RV Series Router Firmware from Cisco. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 99.9% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.0)7.5High
Exploit odds (30 days)99.9%top 0.0% of all CVEs
Exploited in the wildYesCISA KEV since Nov 3, 2021
Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and requesting specific URLs. A successful exploit could allow the attacker to download the router configuration or detailed diagnostic information. Cisco has released firmware updates that address this vulnerability.

Affected products (as reported)

VendorProductVersions
Cisco Cisco Small Business RV Series Router Firmware n/a

Weakness: CWE-284 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References