CVE-2019-1653

What are Cisco RV320 and RV325 Routers?

The Cisco RV320 and RV325 dual-WAN VPN routers are aimed at small businesses needing site-to-site VPN connectivity and a firewall/router in one device. Their web management interface exposes diagnostic and configuration-export functionality intended for administrators — functionality that, if improperly access-controlled, can leak sensitive data to anyone who can reach the interface.

Overview

CVE-2019-1653 is an information disclosure vulnerability in the web-based management interface of Cisco RV320 and RV325 routers. Due to improper access controls on certain URLs, an unauthenticated remote attacker can retrieve the router's full configuration file or detailed diagnostic information — without needing any credentials. CVSS 3.1 base score 7.5 (High).

Technical Details

This is CWE-284 (Improper Access Control). Specific diagnostic and configuration-export endpoints in the management interface fail to verify that the requester is an authenticated administrator before returning data, so a simple, unauthenticated HTTP request to the correct URL returns configuration content — which can include password hashes, VPN pre-shared keys, and other network configuration details. This flaw was disclosed alongside CVE-2019-1652 (authenticated command injection): an attacker can use this bug to harvest credentials, then use those credentials with 1652 to gain command execution, chaining unauthenticated recon directly into root-level compromise.

Discovery

The vulnerability was discovered and reported to Cisco by RedTeam Pentesting GmbH in early 2019, alongside the related command-injection flaw CVE-2019-1652.

Exploitation Context

CISA added CVE-2019-1653 to the KEV catalog in November 2021. Because it requires no authentication and directly exposes sensitive router configuration data, it was heavily scanned for and exploited shortly after public disclosure and proof-of-concept code release, with compromised routers used both for direct network intrusion and to build botnet infrastructure.

Remediation

1. Apply the Cisco firmware update addressing CVE-2019-1653 for the affected RV320/RV325 hardware and firmware version.
2. Disable remote (WAN-side) access to the management interface entirely; restrict configuration access to the trusted LAN only.
3. Rotate all credentials, VPN pre-shared keys, and any secrets stored in the router configuration if the device was ever exposed to the internet while unpatched.
4. Treat this vulnerability together with CVE-2019-1652, since together they form a practical unauthenticated-to-root exploit chain.
5. Replace end-of-life RV-series routers that no longer receive firmware updates with currently supported hardware.