CVE-2019-1652
HIGH KEVCisco RV320 and RV325 Firmware 1.4.2.15-1.4.2.21 - Authenticated Remote Code Execution via HTTP POST Request
Title source: llmExploitation Summary
CVE-2019-1652 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 3, 2022.
EIP tracks 4 public exploits from researchers including Metasploit, RedTeam Pentesting, 0x27, including a Metasploit module exploits/linux/http/cisco_rv32x_rce.
AI-analyzed exploit summary This Metasploit module exploits CVE-2019-1653 (info disclosure) and CVE-2019-1652 (command injection) to achieve unauthenticated RCE on Cisco RV320/RV325 routers. It downloads credentials via config export, logs in, and injects a command via certificate generation.
Description
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux shell as root. Cisco has released firmware updates that address this vulnerability.
Exploits (4)
This Metasploit module exploits CVE-2019-1653 (info disclosure) and CVE-2019-1652 (command injection) to achieve unauthenticated RCE on Cisco RV320/RV325 routers. It downloads credentials via config export, logs in, and injects a command via certificate generation.
This exploit demonstrates a command injection vulnerability in the Cisco RV320 router's web-based certificate generator feature. The vulnerability allows attackers with administrative access to execute arbitrary commands via the 'common_name' parameter in an HTTP POST request.
This repository contains functional exploit code for CVE-2019-1652 and CVE-2019-1653, targeting Cisco RV320/RV325 routers. It includes scripts for dumping configurations, debug data, decrypting diagnostic files, and achieving post-authentication RCE via command injection.
This Metasploit module exploits CVE-2019-1652, a command injection vulnerability in Cisco RV320 and RV325 routers, combined with CVE-2019-1653 (information disclosure) to achieve unauthenticated remote code execution. It downloads the router's configuration to extract credentials, logs in, and injects a malicious command via the certificate generation page.
References (9)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H