CVE-2019-1653 Cisco Small Business RV320 and RV325 Routers Information Disclosure

Exploited in the wild High 7.5 Published 24 Jan 2019 Updated 21 Oct 2025

Unauthenticated remote attackers can retrieve sensitive router configuration and diagnostic information via improper access controls in the web interface.

Exploited in the wild: Since 3 Nov 2021
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-1653?

CVE-2019-1653 is a high-severity vulnerability in Cisco Rv320 Firmware, published on 24 Jan 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and requesting specific URLs. A successful exploit could allow the attacker to download the router configuration or detailed diagnostic information. Cisco has released firmware updates that address this vulnerability.

Weakness: CWE-284

Which versions are affected by CVE-2019-1653?

It affects 2 products.

Products include Cisco Rv320 Firmware, Cisco Rv325 Firmware.

How do I fix CVE-2019-1653?

No fix has been published for CVE-2019-1653 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.

Is CVE-2019-1653 being exploited?

Yes. Attackers have exploited CVE-2019-1653 in the wild since at least 3 Nov 2021.

Public exploit code: 2 Metasploit modules, 2 Exploit-DB entries, 1 Nuclei template and 4 proofs of concept on GitHub.

All Cisco Rv320 Firmware vulnerabilities

Sources

Also known as GHSA-j8w2-wx5p-fvx4.