New Exploit Threatens Over 9,000 Hackable Cisco RV320/RV325 Routers Worldwide
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-1652 | Authenticated Command Injection in Cisco RV320/RV3325 Small Business Routers CVE-2019-1652 is an improper input validation flaw (CWE-20, leading to command injection per CWE-78) in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN routers. An authenticated, remote attacker who already holds administrative privileges on the device exploits it by sending crafted HTTP POST requests to the management interface, and a successful exploit allows arbitrary command execution as root on the underlying Linux shell. Because administrative credentials are required, the bug is typically a second stage of an attack on an internet-facing edge router rather than a standalone entry point. All RV320 and RV325 routers running firmware predating the firmware updates Cisco released are affected, and these models have since reached end-of-life. Exploitation is confirmed in the wild: the vulnerability was added to CISA's KEV catalog on 2022-03-03, carries a 95.9% EPSS probability (100th percentile), has had public PoCs since 2019, and news coverage reports attackers — including China-linked groups — targeting the roughly 9,000 RV320/RV325 units exposed online. Do: Apply the firmware updates Cisco released for the RV320/RV325 per the vendor advisory, as required by the CISA KEV listing, and since these routers are end-of-life, plan hardware replacement where the updated firmware cannot be installed. In the interim, restrict access to the web-based management interface to trusted networks only and check exposed devices for signs of compromise, given active targeting by China-linked threat actors. | 7.2 | 96% | KEV PoC ×5 |
| moderate≈9,000+ internet-exposed RV320/RV325 routers per public scans; total deployed base unknown but larger | |
| CVE-2019-1653 | Unauthenticated Config Disclosure in Cisco RV320/RV325 Routers CVE-2019-1653 is an improper access control flaw (CWE-284) in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN routers. It is triggered by sending requests to vulnerable URLs on the management interface without authentication, bypassing the intended access controls. An attacker gains the ability to download the full router configuration — which can expose credentials and VPN/VPN-tunnel settings — as well as detailed diagnostic information about the device. Any Cisco RV320 or RV325 router whose management interface is reachable, particularly over the internet, is affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and carries a 99.9% EPSS score, though no public proof-of-concept is known and no ransomware association has been confirmed. Do: Apply the updated router firmware from Cisco as instructed in the vendor advisory, per the CISA KEV required action. If updating is not immediately possible, restrict or disable WAN-side access to the web management interface and limit it to trusted management hosts. Because the downloaded configuration can contain credentials, change administrative and VPN passwords after patching, and review logs for signs of unauthenticated configuration downloads. | 7.5 | 100% | KEV PoC ×5 |
| largetens of thousands of internet-exposed routers (public internet-wide scans at disclosure found on the order of 20,000–30,000 RV320/RV325 devices with reachable… |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 1.4.2.15 | V325 dual gigabit WAN VPN routers running firmware versions 1.4.2.15 through 1.4.2.19, and the second affects firmware versions |
| ipv4 | 1.4.2.17 | 2.19, and the second affects firmware versions 1.4.2.15 and 1.4.2.17, according to the Cisco’s advisory . Both the vulnerabiliti |
| ipv4 | 1.4.2.19 | WAN VPN routers running firmware versions 1.4.2.15 through 1.4.2.19, and the second affects firmware versions 1.4.2.15 and 1.4. |
Full article440 words · extracted from thehackernews.com · click to collapse
The Hacker NewsJan 28, 2019
If the connectivity and security of your organization rely on Cisco RV320 or RV325 Dual Gigabit WAN VPN routers, then you need to immediately install the latest firmware update released by the vendor last week.
Cyber attackers have actively been exploiting two newly patched high-severity router vulnerabilities in the wild after a security researcher released their proof-of-concept exploit code on the Internet last weekend.
The vulnerabilities in question are a command injection flaw (assigned CVE-2019-1652) and an information disclosure flaw (assigned CVE-2019-1653), a combination of which could allow a remote attacker to take full control of an affected Cisco router.
The first issue exists in RV320 and RV325 dual gigabit WAN VPN routers running firmware versions 1.4.2.15 through 1.4.2.19, and the second affects firmware versions 1.4.2.15 and 1.4.2.17, according to the Cisco’s advisory.
Both the vulnerabilities, discovered and responsibly reported to the company by German security firm RedTeam Pentesting, actually resides in the web-based management interface used for the routers and are remotely exploitable.
- CVE-2019-1652—The flaw allows an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands on the system.
- CVE-2019-1653—This flaw doesn't require any authentication to reach the router's web-based management portal, allowing attackers to retrieve sensitive information including the router's configuration file containing MD5 hashed credentials and diagnostic information.
The PoC exploit code targeting Cisco RV320/RV325 routers published on the Internet first exploits CVE-2019-1653 to retrieve the configuration file from the router to obtain its hashed credentials and then exploits CVE-2019-1652 to execute arbitrary commands and gain complete control of the affected device.
Researchers from cybersecurity firm Bad Packets said they found at least 9,657 Cisco routers (6,247 RV320 and 3,410 RV325) worldwide that are vulnerable to the information disclosure vulnerability, most of which located in the United States.
The firm shared an interactive map, showing all vulnerable RV320/RV325 Cisco routers in 122 countries and on the network of 1,619 unique internet service providers.
Bad Packets said its honeypots detected opportunistic scanning activity for vulnerable routers from multiple hosts from Saturday, suggesting the hackers are actively trying to exploit the flaws to take full control of the vulnerable routers.
The best way to protect yourself from becoming the target of one such attack is to install the latest Cisco RV320 and RV325 Firmware release 1.4.2.20 as soon as possible.
Administrators who have not yet applied the firmware update are highly recommended to change their router's admin and WiFi credentials considering themselves already compromised.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2019/01/hacking-cisco-routers.html