A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux shell as root. Cisco has released firmware updates that address this vulnerability.

According to its self-reported version, this Cisco Small Business RV320 router is affected by multiple vulnerabilities:

 - A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands.The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux shell as root. (CVE-2019-1652)
 - A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information.The vulnerability is due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and requesting specific URLs. A successful exploit could allow the attacker to download the router configuration or detailed diagnostic information. (CVE-2019-1653)

According to its self-reported version, this Cisco Small Business RV Series router is affected by multiple vulnerabilities:

  - A vulnerability in the web-based management interface of     Cisco Small Business RV320 and RV325 Dual Gigabit WAN     VPN Routers could allow an authenticated, remote     attacker with administrative privileges on an affected     device to execute arbitrary commands.The vulnerability     is due to improper validation of user-supplied input. An     attacker could exploit this vulnerability by sending     malicious HTTP POST requests to the web-based management     interface of an affected device. A successful exploit     could allow the attacker to execute arbitrary commands     on the underlying Linux shell as root. (CVE-2019-1652)

  - A vulnerability in the web-based management interface of     Cisco Small Business RV320 and RV325 Dual Gigabit WAN     VPN Routers could allow an unauthenticated, remote     attacker to retrieve sensitive information.The     vulnerability is due to improper access controls for     URLs. An attacker could exploit this vulnerability by     connecting to an affected device via HTTP or HTTPS and     requesting specific URLs. A successful exploit could     allow the attacker to download the router configuration     or detailed diagnostic information. (CVE-2019-1653)

Please see the included Cisco BIDs and Cisco Security Advisory for more information

ID	Name	Product	Family	Type	Severity
700567	Cisco RV325 < 1.4.2.22 Multiple Vulnerabilities	Nessus Network Monitor	SNMP		high
700566	Cisco RV320 < 1.4.2.22 Multiple Vulnerabilities	Nessus Network Monitor	SNMP		high
124060	Cisco Small Business RV320 and RV325 Routers Multiple Vulnerabilities (cisco-sa-20190123-rv-inject, cisco-sa-20190123-rv-info)	Nessus	CISCO	Remote	high

Detections

Analytics

CVE-2019-1652

high

Tenable Plugins

high

high

high