CVE-2019-1653: Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability

Vulnerability summary

CVE-2019-1653 is a high (CVSS 7.5) Improper Access Control vulnerability in Cisco Small Business RV320 and RV325 Routers. It is known to be exploited: CISA lists it, first on 03-11-2021. EPSS estimates a 99.88% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 8 public exploits are recorded.

Timeline

1. 24-01-2019
   PublishedVulnerability first disclosed.
2. 03-11-2021
   Added to CISA KEVExploitedCisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
3. 03-05-2022
   CISA remediation dueDeadline passedApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and requesting specific URLs. A successful exploit could allow the attacker to download the router configuration or detailed diagnostic information. Cisco has released firmware updates that address this vulnerability.

• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.