CVE-2019-1652VulnerabilityPublished 03/03/2022Updated 10/24/2026

CVE-2019-1652: Cisco Small Business Routers Improper Input Validation Vulnerability

Affects Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN RoutersSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/03/2022
KEV deadline: 03/17/2022
EPSS: 95.9% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2019-1652 (opens in a new tab)

Description

CVE-2019-1652 is a high-severity vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers. It allows an authenticated remote attacker with administrative privileges to execute arbitrary commands on the affected device. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

Summary

This vulnerability involves improper input validation in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers. An attacker who is authenticated with administrative privileges can exploit this flaw to execute arbitrary commands remotely on the device. The vulnerability is identified as CWE-20 (Improper Input Validation). It has been observed to be exploited in the wild, indicating active threat usage. However, no explicit patch or remediation details are provided in the input data.

Impact

An authenticated remote attacker with administrative access to the affected Cisco Small Business routers can execute arbitrary commands, potentially leading to full control over the device. This can compromise network security, disrupt operations, and facilitate further attacks within the network environment.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability requires administrative authentication, limiting administrative access to trusted personnel and networks can reduce risk. Monitor Cisco's official advisories for updates on patches or fixes.

Weaknesses

CWE-20Improper Input Validation (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 10:41:17 UTC

Weaknesses

References

Related threats