CVE-2019-1652

What are Cisco RV320 and RV325 Routers?

The Cisco RV320 and RV325 are dual-WAN gigabit VPN routers marketed to small businesses for internet connectivity and site-to-site VPN. Their web-based management interface allows administrators to configure networking, VPN, and diagnostic settings remotely — functionality that, when exposed to the internet, becomes a valuable target given how many small offices left these interfaces reachable from the WAN side.

Overview

CVE-2019-1652 is a vulnerability in the web-based management interface of Cisco RV320 and RV325 routers that allows an authenticated, remote attacker with administrative credentials to execute arbitrary commands on the underlying operating system. CVSS 3.1 base score 7.2 (High), requiring high privileges (valid admin credentials) but no user interaction.

Technical Details

This is CWE-20 (Improper Input Validation). Certain fields in the management interface — used for diagnostic or configuration commands — do not properly validate user-supplied input before passing it to underlying system commands, allowing an authenticated administrator-level user to append arbitrary shell commands. It was disclosed together with CVE-2019-1653 (an unauthenticated information-disclosure flaw), which meant an attacker could first harvest configuration data — including password hashes — via 1653, crack or reuse them, and then use those credentials to reach the authenticated command injection in 1652, forming a practical unauthenticated-to-root exploit chain even though 1652 alone requires authentication.

Discovery

The vulnerability was discovered and reported to Cisco by RedTeam Pentesting GmbH, a German security research firm, in early 2019, alongside the related information-disclosure bug CVE-2019-1653.

Exploitation Context

CISA added CVE-2019-1652 to the KEV catalog in March 2022. Public proof-of-concept exploit code for both the RV320/325 information disclosure and command injection chain circulated shortly after disclosure, and Cisco RV-series routers running default or weak credentials were widely scanned and compromised by opportunistic attackers and botnets seeking edge-network footholds throughout 2019.

Remediation

1. Apply the Cisco firmware update that resolves CVE-2019-1652 for your specific RV320/RV325 hardware and firmware version.
2. Change default administrative credentials immediately and enforce strong, unique passwords.
3. Disable remote (WAN-side) management access to the router's web interface; restrict administration to the trusted LAN.
4. Treat this vulnerability together with CVE-2019-1653 — patching one without the other still leaves the pre-authentication information-disclosure path open to credential harvesting.
5. Replace end-of-life RV-series hardware that no longer receives security updates with a currently supported model.