CVE-2019-1652
Cisco Small Business Routers Improper Input Validation Vulnerability
Published Jan 24, 2019 · updated Jun 16, 2026 · cisco rv320 firmware
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux shell as root. Cisco has released firmware updates that address this vulnerability.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Jan 24, 2019 · Catalog
Detected
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST
Mar 3, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Mar 17, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST
Required action
Apply updates per vendor instructions.
CISA due date Mar 17, 2022
Affected
- cpe cisco/rv320 firmwareversion unspecified
- cpe cisco/rv325 firmwareversion unspecified
- vendor Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routersversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2019-1652
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands.
cisa.gov - CVE.orgVulnerability recordCVE-2019-1652
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2019-1652
30-day exploitation probability 95.9%
first.org - Exploit DatabasePublic exploit reference46243
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit DatabasePublic exploit reference46655
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit ModulesPublic exploit moduleexploit_linux/http/cisco_rv32x_rce
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com - NIST NVDVulnerability recordCVE-2019-1652
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to
nvd.nist.gov - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/152262/Cisco-RV320-Command-Injection.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/152305/Cisco-RV320-RV325-Unauthenticated-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com