CVE-2019-1652: Cisco RV320/RV325 web interface command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

high priorityThe flaw allows root command execution on an edge device, is listed in CISA KEV with a very high EPSS score, and has public exploit code, though exploitation requires valid administrative credentials.

What it is

The web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers fails to properly validate user-supplied input, allowing command injection. An authenticated attacker with administrative privileges can send crafted HTTP POST requests to run arbitrary commands on the underlying Linux shell as root. Cisco has released firmware updates that fix the flaw.

Impact

An attacker gains root-level command execution on the router's Linux shell, giving full control of the device and its traffic. Because the device sits at the network edge, that control can be used to intercept or redirect traffic and pivot into the internal network.

Attack surface

Reached remotely over the network through the web-based management interface via malicious HTTP POST requests. The CVSS vector (PR:H, UI:N) and description indicate the attacker must already hold administrative credentials on the device; no user interaction is required.

Exploitation

CVE-2019-1652 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03) and has a very high EPSS 30-day probability of about 0.96 (99.9th percentile). Multiple references are tagged Exploit, including public exploit-db and Packet Storm entries, so working exploit code is publicly available.

What to do

• Apply the Cisco firmware updates referenced in the vendor advisory cisco-sa-20190123-rv-inject as the first action.
• If the device cannot be patched immediately, disable or restrict remote management access to the web interface and block it from untrusted networks.
• Change default and weak administrative credentials and enforce strong, unique passwords for the management interface.
• Place the router behind restrictive firewall rules and limit management access to trusted administrative hosts only.
• Monitor for end-of-support hardware and plan replacement if firmware updates are no longer provided.

Detection

• Review HTTP POST requests to the router's web management interface for command-injection patterns or shell metacharacters in parameters.
• Alert on unexpected outbound connections or processes spawned from the router, which may indicate post-exploitation activity.
• Audit administrative login logs for anomalous source IPs or logins outside normal maintenance windows.
• Use the public exploit-db and Packet Storm proof-of-concept requests to build signatures for known exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.