CVE-2019-1653

mediumpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.999 · 100 %ileexploit · functionalEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 8 exploits · functional

Likely / severe?

99.9% (100th) EPSS

CVSS 5 · medium

Is it mine?

10 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisco_csaf

added 2021-11-03remediate by 2022-05-03

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-25

Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and requesting specific URLs. A successful exploit could allow the attacker to download the router configuration or detailed diagnostic information. Cisco has released firmware updates that address this vulnerability.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedCisco Small Business RV Series Router Firmwarecisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5

v2.05mediumAV:N/AC:L/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 10 · impact 2.9

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · ENISA EU

v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · psirt@cisco.com USexploitability 3.9 · impact 3.6

v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · Cisco PSIRT US

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-284USCWE-284US

ATT&CK techniques

ATT&CK techniques this enables or maps to.

exploits (8)

Public proof-of-concept and weaponised exploit code.

EDB-46655Cisco RV320 and RV325 - Unauthenticated Remote Code Execution (Metasploit)functional · exploit_db
auxiliary/gather/cisco_rv320_configCisco RV320/RV326 Configuration Disclosurefunctional · metasploit
exploit/linux/http/cisco_rv32x_rceCisco RV320 and RV325 Unauthenticated Remote Code Executionfunctional · metasploit
EDB-46262Cisco RV300 / RV320 - Information DisclosurePoC · exploit_db
dubfr33/CVE-2019-1653NSE script to scan for Cisco routers vulnerable to CVE-2019-1653PoC · poc_in_github
elzerjp/nuclei-CiscoRV320Dump-CVE-2019-1653CiscoRV320Dump CVE-2019-1653 - Automatition. PoC · poc_in_github

affected products (10)

Products and version ranges known to be affected.

Cisco Cisco Small Business RV Series Router Firmwareall versionscisco_csafUS
Cisco Cisco Small Business RV Series Router Firmware≤ n/aenisa_euvdEU
Cisco Systems Inc. Cisco Small Business RV320≤ 1.4.2.17fstec_bduRU
Cisco Systems Inc. Cisco Small Business RV320≤ 1.4.2.15fstec_bduRU
Cisco Systems Inc. Cisco Small Business RV325≤ 1.4.2.15fstec_bduRU
Cisco Systems Inc. Cisco Small Business RV325≤ 1.4.2.17fstec_bduRU
cisco rv320 firmware= 1.4.2.15nvdUScpe:2.3:o:cisco:rv320_firmware:*:*:*:*:*:*:*:*
cisco rv320 firmware= 1.4.2.17nvdUScpe:2.3:o:cisco:rv320_firmware:*:*:*:*:*:*:*:*
cisco rv325 firmware= 1.4.2.15nvdUScpe:2.3:o:cisco:rv325_firmware:*:*:*:*:*:*:*:*
cisco rv325 firmware= 1.4.2.17nvdUScpe:2.3:o:cisco:rv325_firmware:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

cisco-sa-20190123-rv-infoCisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability2019-01-23csaf · cisco_csafUS
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and requesting specific URLs. A successful exploit could allow the attacker to download the router configuration or detailed diagnostic information. Update, April 4, 2019: The initial fix for this vulnerability was found to be incomplete. The complete fix is now available in Firmware Release 1.4.2.22. Firmware updates that address this vulnerability are currently available. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info"]

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisco_csaf nvd NVD CVE.org MITRE

published 2019-01-24modified 2026-06-17

references (52)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan