CVE-2019-1652

Related Files

Cisco RV320 / RV325 Unauthenticated Remote Code Execution

Posted Mar 30, 2019

Authored by Philip Huppert, RedTeam Pentesting GmbH, Benjamin Grap | Site metasploit.com

This Metasploit module combines an information disclosure (CVE-2019-1653) and a command injection vulnerability (CVE-2019-1652) together to gain unauthenticated remote code execution on Cisco RV320 and RV325 small business routers. Can be exploited via the WAN interface of the router. Either via HTTPS on port 443 or HTTP on port 8007 on some older firmware versions.

tags | exploit, remote, web, code execution, info disclosure

systems | cisco

advisories | CVE-2019-1652, CVE-2019-1653

SHA-256 | 3a5930431c87e0e5f639afb9c3aa17008a55b97dc03414a6b04b7d6a4f631c82

Download | Favorite | View

Cisco RV320 Command Injection

Posted Mar 27, 2019

Site redteam-pentesting.de

RedTeam Pentesting discovered a command injection vulnerability in the web-based certificate generator feature of the Cisco RV320 router which was inadequately patched by the vendor.

tags | exploit, web

systems | cisco

advisories | CVE-2019-1652

SHA-256 | fa1fddffe139a0d576a787664aa6b3b1d1207ed373110904ad3b88fa8d1e4370

Download | Favorite | View

Cisco RV320 Command Injection

Posted Jan 24, 2019

Site redteam-pentesting.de

RedTeam Pentesting discovered a command injection vulnerability in the web-based certificate generator feature of the Cisco RV320 router. Versions 1.4.2.15 through 1.4.2.19 are affected. Fixed in version 1.4.2.20.

tags | exploit, web

systems | cisco

advisories | CVE-2019-1652

SHA-256 | 0ef1e407d0628e9e533465222b68937646fa1649db7cb36d50953a7f19722bfc

Download | Favorite | View