CVE-2019-1652

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux shell as root. Cisco has released firmware updates that address this vulnerability.

• CWE-20
• CWE-78

• http://packetstormsecurity.com/files/152262/Cisco-RV320-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/152305/Cisco-RV320-RV325-Unauthenticated-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Mar/61Exploit, Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/106728Third Party Advisory, VDB Entry
• https://seclists.org/bugtraq/2019/Mar/55Exploit, Mailing List, Third Party Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-injectVendor Advisory
• https://www.exploit-db.com/exploits/46243/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/46655/Exploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/152262/Cisco-RV320-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/152305/Cisco-RV320-RV325-Unauthenticated-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Mar/61Exploit, Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/106728Third Party Advisory, VDB Entry
• https://seclists.org/bugtraq/2019/Mar/55Exploit, Mailing List, Third Party Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-injectVendor Advisory
• https://www.exploit-db.com/exploits/46243/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/46655/Exploit, Third Party Advisory, VDB Entry
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1652US Government Resource

Published

Jan 24, 2019

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16514An issue was discovered in ConnectWise Control (formerly kno…7.2
• CVE-2019-16515An issue was discovered in ConnectWise Control (formerly kno…6.5
• CVE-2019-16516An issue was discovered in ConnectWise Control (formerly kno…5.3
• CVE-2019-16517An issue was discovered in ConnectWise Control (formerly kno…9.8
• CVE-2019-16518An issue was discovered on Swell Kit Mod devices that use th…4.3
• CVE-2019-16519ESET Cyber Security 6.7.900.0 for macOS allows a local attac…7.8
• CVE-2019-16520The all-in-one-seo-pack plugin before 3.2.7 for WordPress (a…5.4
• CVE-2019-16521The broken-link-checker plugin through 1.11.8 for WordPress …6.1
• CVE-2019-16522The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU…4.8
• CVE-2019-16523The events-manager plugin through 5.9.5 for WordPress (aka E…5.4
• CVE-2019-16524The easy-fancybox plugin before 1.8.18 for WordPress (aka Ea…4.8
• CVE-2019-16525An XSS issue was discovered in the checklist plugin before 1…6.1