CVE-2019-1652
HighExploitedPublic exploitA vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands.
Published Jan 24, 2019 · Updated Oct 28, 2025
Key Facts
Patch immediately- CVE-2019-1652 is a high-severity vulnerability (CVSS 7.2 v3.1) affecting Rv320 Firmware (Cisco), Rv325 Firmware (Cisco), Cisco Small Business RV Series Router Firmware.
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Mar 25, 2020. Public exploit code is available.
- EPSS estimates a 96% probability of exploitation in the next 30 days.
- Fixed versions are available, including Rv320 Firmware 1.4.2.22, Rv325 Firmware 1.4.2.22.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
7.2
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
96%
Higher than 99.8% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2019-1652 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux shell as root. Cisco has released firmware updates that address this vulnerability.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Mar 3, 2022 | Mar 17, 2022 | Not reported |
| Industry KEV feed | Mar 25, 2020 | Mar 17, 2022 | Not reported |
| CIRCL KEV | Mar 3, 2022 | Mar 17, 2022 | Not reported |
| ENISA EUVD | Mar 3, 2022 | n/a | Not reported |
Required action: Apply updates per vendor instructions.
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Rv320 FirmwareCisco | See advisory | 1.4.2.22 |
| Rv325 FirmwareCisco | See advisory | 1.4.2.22 |
| Cisco Small Business RV Series Router Firmware | >= n/a | n/a |
Patched Releases
Rv320 Firmware
1.4.2.22
Rv325 Firmware
1.4.2.22
Timeline
Publicly disclosed
Jan 24, 2019
Added to Industry KEV feed
Mar 25, 2020
Added to CISA KEV
Mar 3, 2022
Added to CIRCL KEV
Mar 3, 2022
Added to ENISA EUVD
Mar 3, 2022
Last updated
Oct 28, 2025
Weakness Type
- CWE-20 Improper Input Validation
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
References
- advisoryhttp://packetstormsecurity.com/files/152305/Cisco-RV320-RV325-Unauthenticated-Remote-Code-Execution.html
- advisory20190123 Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability
- advisory106728
- exploithttp://packetstormsecurity.com/files/152262/Cisco-RV320-Command-Injection.html
- exploitVulnCheck exploitation report
FAQ
Common Questions.
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands.
Affected: Rv320 Firmware (Cisco); Rv325 Firmware (Cisco); Cisco Small Business RV Series Router Firmware versions >= n/a. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Mar 25, 2020.
Yes. It was added on Mar 3, 2022 with a federal remediation due date of Mar 17, 2022.
Public exploit code is available.
Fixed versions are available, including Rv320 Firmware 1.4.2.22, Rv325 Firmware 1.4.2.22.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2019-1652 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo