cnvd - cnvd-2019-02747

cnvd-2019-02747

Vulnerability from cnvd

Title: Cisco Small Business RV320和RV325命令注入漏洞

Description:

Cisco Small Business RV320和RV325都是美国思科（Cisco）公司的企业级路由器。

使用1.4.2.15版本至1.4.2.19版本固件的Cisco Small Business RV320和RV325中存在命令注入漏洞，该漏洞源于程序未能正确地验证用户提交的输入，远程攻击者可通过发送特制的HTTP POST请求利用该漏洞以root权限在底层Linux shell上执行任意代码。

Severity: 高

Patch Name: Cisco Small Business RV320和RV325命令注入漏洞的补丁

Patch Description:

Cisco Small Business RV320和RV325都是美国思科（Cisco）公司的企业级路由器。

使用1.4.2.15版本至1.4.2.19版本固件的Cisco Small Business RV320和RV325中存在命令注入漏洞，该漏洞源于程序未能正确地验证用户提交的输入，远程攻击者可通过发送特制的HTTP POST请求利用该漏洞以root权限在底层Linux shell上执行任意代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-inject

Reference: https://www.auscert.org.au/bulletins/74530

Impacted products

Name
['Cisco Cisco Small Business RV320 >=1.4.2.15，<=1.4.2.19', 'Cisco Cisco Small Business RV325 >=1.4.2.15，<=1.4.2.19']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-1652"
    }
  },
  "description": "Cisco Small Business RV320\u548cRV325\u90fd\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u4f01\u4e1a\u7ea7\u8def\u7531\u5668\u3002\n\n\u4f7f\u75281.4.2.15\u7248\u672c\u81f31.4.2.19\u7248\u672c\u56fa\u4ef6\u7684Cisco Small Business RV320\u548cRV325\u4e2d\u5b58\u5728\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u5730\u9a8c\u8bc1\u7528\u6237\u63d0\u4ea4\u7684\u8f93\u5165\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u53d1\u9001\u7279\u5236\u7684HTTP POST\u8bf7\u6c42\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5root\u6743\u9650\u5728\u5e95\u5c42Linux shell\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "discovererName": "RedTeam Pentesting GmbH",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-inject",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-02747",
  "openTime": "2019-01-25",
  "patchDescription": "Cisco Small Business RV320\u548cRV325\u90fd\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u4f01\u4e1a\u7ea7\u8def\u7531\u5668\u3002\r\n\r\n\u4f7f\u75281.4.2.15\u7248\u672c\u81f31.4.2.19\u7248\u672c\u56fa\u4ef6\u7684Cisco Small Business RV320\u548cRV325\u4e2d\u5b58\u5728\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u5730\u9a8c\u8bc1\u7528\u6237\u63d0\u4ea4\u7684\u8f93\u5165\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u53d1\u9001\u7279\u5236\u7684HTTP POST\u8bf7\u6c42\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5root\u6743\u9650\u5728\u5e95\u5c42Linux shell\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Cisco Small Business RV320\u548cRV325\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Cisco Cisco Small Business RV320 \u003e=1.4.2.15\uff0c\u003c=1.4.2.19",
      "Cisco Cisco Small Business RV325 \u003e=1.4.2.15\uff0c\u003c=1.4.2.19"
    ]
  },
  "referenceLink": "https://www.auscert.org.au/bulletins/74530",
  "serverity": "\u9ad8",
  "submitTime": "2019-01-25",
  "title": "Cisco Small Business RV320\u548cRV325\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e"
}

CVE-2019-1652 (GCVE-0-2019-1652)

Vulnerability from cvelistv5

Published

2019-01-24 16:00

Modified

2025-07-30 01:46

Severity ?

7.2 (High) - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-20

Summary

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux shell as root. Cisco has released firmware updates that address this vulnerability.

References

▼	URL	Tags
	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-inject	vendor-advisory, x_refsource_CISCO
	https://www.exploit-db.com/exploits/46243/	exploit, x_refsource_EXPLOIT-DB
	http://www.securityfocus.com/bid/106728	vdb-entry, x_refsource_BID
	http://seclists.org/fulldisclosure/2019/Mar/61	mailing-list, x_refsource_FULLDISC
	https://seclists.org/bugtraq/2019/Mar/55	mailing-list, x_refsource_BUGTRAQ
	http://packetstormsecurity.com/files/152262/Cisco-RV320-Command-Injection.html	x_refsource_MISC
	http://packetstormsecurity.com/files/152305/Cisco-RV320-RV325-Unauthenticated-Remote-Code-Execution.html	x_refsource_MISC
	https://www.exploit-db.com/exploits/46655/	exploit, x_refsource_EXPLOIT-DB

Impacted products

	Vendor	Product	Version
	Cisco	Cisco Small Business RV Series Router Firmware	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T18:20:28.337Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20190123 Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-inject"
          },
          {
            "name": "46243",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/46243/"
          },
          {
            "name": "106728",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106728"
          },
          {
            "name": "20190327 [RT-SA-2019-005] Cisco RV320 Command Injection Retrieval",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2019/Mar/61"
          },
          {
            "name": "20190327 [RT-SA-2019-005] Cisco RV320 Command Injection Retrieval",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Mar/55"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/152262/Cisco-RV320-Command-Injection.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/152305/Cisco-RV320-RV325-Unauthenticated-Remote-Code-Execution.html"
          },
          {
            "name": "46655",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/46655/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2019-1652",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-08T17:20:43.659526Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2022-03-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1652"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-30T01:46:09.178Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "timeline": [
          {
            "lang": "en",
            "time": "2022-03-03T00:00:00+00:00",
            "value": "CVE-2019-1652 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco Small Business RV Series Router Firmware",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2019-01-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux shell as root. Cisco has released firmware updates that address this vulnerability."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-04-03T19:06:07.000Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "20190123 Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-inject"
        },
        {
          "name": "46243",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/46243/"
        },
        {
          "name": "106728",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106728"
        },
        {
          "name": "20190327 [RT-SA-2019-005] Cisco RV320 Command Injection Retrieval",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2019/Mar/61"
        },
        {
          "name": "20190327 [RT-SA-2019-005] Cisco RV320 Command Injection Retrieval",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2019/Mar/55"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/152262/Cisco-RV320-Command-Injection.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/152305/Cisco-RV320-RV325-Unauthenticated-Remote-Code-Execution.html"
        },
        {
          "name": "46655",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/46655/"
        }
      ],
      "source": {
        "advisory": "cisco-sa-20190123-rv-inject",
        "defect": [
          [
            "CSCvm78058"
          ]
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "DATE_PUBLIC": "2019-01-23T16:00:00-0800",
          "ID": "CVE-2019-1652",
          "STATE": "PUBLIC",
          "TITLE": "Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cisco Small Business RV Series Router Firmware",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Cisco"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux shell as root. Cisco has released firmware updates that address this vulnerability."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
          }
        ],
        "impact": {
          "cvss": {
            "baseScore": "7.2",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-20"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20190123 Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-inject"
            },
            {
              "name": "46243",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/46243/"
            },
            {
              "name": "106728",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106728"
            },
            {
              "name": "20190327 [RT-SA-2019-005] Cisco RV320 Command Injection Retrieval",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2019/Mar/61"
            },
            {
              "name": "20190327 [RT-SA-2019-005] Cisco RV320 Command Injection Retrieval",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2019/Mar/55"
            },
            {
              "name": "http://packetstormsecurity.com/files/152262/Cisco-RV320-Command-Injection.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/152262/Cisco-RV320-Command-Injection.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/152305/Cisco-RV320-RV325-Unauthenticated-Remote-Code-Execution.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/152305/Cisco-RV320-RV325-Unauthenticated-Remote-Code-Execution.html"
            },
            {
              "name": "46655",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/46655/"
            }
          ]
        },
        "source": {
          "advisory": "cisco-sa-20190123-rv-inject",
          "defect": [
            [
              "CSCvm78058"
            ]
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2019-1652",
    "datePublished": "2019-01-24T16:00:00.000Z",
    "dateReserved": "2018-12-06T00:00:00.000Z",
    "dateUpdated": "2025-07-30T01:46:09.178Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted