CVE-2019-1828: Cisco Small Business RV320 and RV325 Routers Weak Credential Encryption Vulnerability
Vulnerability summary
CVE-2019-1828 is a high (CVSS 8.1) vulnerability in cisco cisco small business rv series router firmware. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 52.4% of scored vulnerabilities.
Timeline
- 04-04-2019PublishedVulnerability first disclosed.
- 21-11-2024Last modifiedVulnerability information updated.
Description
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to access administrative credentials. The vulnerability exists because affected devices use weak encryption algorithms for user credentials. An attacker could exploit this vulnerability by conducting a man-in-the-middle attack and decrypting intercepted credentials. A successful exploit could allow the attacker to gain access to an affected device with administrator privileges. This vulnerability affects Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers running firmware releases prior to 1.4.2.22.
CVSS metrics
3 scores · 2 sources · 2 versions- CVE.orgCNA5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
0.69%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.69% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Cisco3 products
- cisco small business rv series router firmware≥ unspecified, < 1.4.2.22
- rv320_firmware< 1.4.2.22
- rv325_firmware< 1.4.2.22
1 vendor · 3 products
References
2 links- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190404-rv-weak-encryptVendor AdvisoryX Refsource CISCO