CVE-2019-1652

Cisco Small Business RV320/RV325 routers had an improper input validation flaw allowing authenticated remote attackers to execute arbitrary commands.

The web-based management interface of Cisco Small Business RV320 and RV325 routers suffered from improper input validation, enabling authenticated remote attackers with administrative privileges to execute arbitrary commands. DIB organizations must care because this RCE flaw, listed in CISA's KEV catalog, indicates a known, actively exploited vulnerability that could compromise network integrity and violate CMMC/NIST 800-171 controls if unpatched. Organizations should immediately verify patch levels on all legacy Cisco Small Business routers and replace them with hardened alternatives.

Shame score — A known, actively exploited RCE vulnerability in widely deployed small business routers demonstrates negligent security development and prolonged exposure to active exploitation.