Loading vulnerability…
CVE-2019-1652 is a command injection vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers. The flaw is caused by improper validation of user-supplied input in HTTP POST requests handled by the management interface. An authenticated remote attacker with administrative privileges can submit crafted input to the interface and cause arbitrary commands to be executed on the underlying Linux shell with root privileges.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a single Metasploit module (modules/exploits/linux/http/cisco_rv32x_rce.rb) targeting Cisco RV320 and RV325 routers. The exploit leverages two vulnerabilities: an information disclosure (CVE-2019-1653) to obtain configuration data (including password hashes), and a command injection (CVE-2019-1652) to achieve unauthenticated remote code execution. The attack is performed over the network via the router's web interface, typically accessible on HTTP port 8007 or HTTPS port 443. The module first downloads the configuration file, extracts credentials, logs in, and then injects a command that causes the router to download and execute a shell payload from the attacker's HTTP server. The exploit is weaponized, allowing for arbitrary command execution as a privileged user. The code is written in Ruby and is structured as a standard Metasploit exploit module, with clear separation of initialization, exploitation, and payload delivery logic. The main fingerprintable endpoints are /cgi-bin/config.exp, /cgi-bin/userLogin.cgi, and /certificate_handle2.htm.
This repository provides operational exploit scripts for Cisco RV320 and RV325 routers vulnerable to CVE-2019-1652 (post-auth RCE) and CVE-2019-1653 (config/debug file disclosure). The main scripts are: - dump_config.py: Dumps the plaintext configuration file from the router's web interface, exposing sensitive information including password hashes. - dump_debug.py: Dumps an encrypted debug/diagnostic file, which can be decrypted using decrypt.sh to recover sensitive files such as /etc/shadow. - exec_cmd.py: Exploits a post-authentication command injection vulnerability to execute arbitrary shell commands as root. Requires valid credentials (default or extracted from config dump). - easy_access.py: Automates the full attack chain by extracting credentials from the config file and using them to authenticate and execute commands, including 'pass the hash' attacks. The exploits target the web management interface (typically HTTPS on port 443 or 8443) and use specific CGI endpoints. The attack vector is network-based, requiring access to the device's web interface. The payload is arbitrary shell command execution, enabling full device compromise. The repository is well-structured, with each script focusing on a specific stage of the attack, and includes a Bash script for decrypting debug files. The code is operational and can be used to achieve root access on unpatched Cisco RV320/325 routers.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An older vulnerability reportedly leveraged by Volt Typhoon to compromise Cisco RV320/325 devices during an observed intrusion window.
A command injection vulnerability in Cisco RV320 routers referenced as an IPS detection associated with APT41-related coverage.
Vulnerability in Cisco RV320 referenced alongside CVE-2019-1653 as part of exploit tooling for dumping configurations/debug data and achieving remote root.
Specific vulnerability listed as an example in EPSS probability rankings; the content does not describe the flaw itself.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.