New Exploit Threatens Over 9,000 Hackable Cisco RV320/RV325 Routers Worldwide

Cyber attackers have actively been exploiting two newly patched
high-severity router vulnerabilities in the wild after a security
researcher released their proof-of-concept
exploit^[1] code on the Internet
last weekend.

The vulnerabilities in question are a command injection flaw
(assigned CVE-2019-1652) and an information disclosure flaw
(assigned CVE-2019-1653), a combination of which could allow a
remote attacker to take full control of an affected Cisco
router.

The first issue exists in RV320 and RV325 dual gigabit WAN VPN
routers running firmware versions 1.4.2.15 through 1.4.2.19, and
the second affects firmware versions 1.4.2.15 and 1.4.2.17,
according to the Cisco’s
advisory.
^[2]

Both the vulnerabilities, discovered and responsibly reported to
the company by German security firm RedTeam Pentesting, actually
resides in the web-based management interface used for the routers
and are remotely exploitable.

• CVE-2019-1652—The flaw allows an authenticated, remote attacker
  with administrative privileges on an affected device to execute
  arbitrary commands on the system.
• CVE-2019-1653—This flaw doesn’t require any authentication to
  reach the router’s web-based management portal, allowing attackers
  to retrieve sensitive information including the router’s
  configuration file containing MD5 hashed credentials and diagnostic
  information.

The PoC exploit code targeting Cisco RV320/RV325 routers published
on the Internet first exploits CVE-2019-1653 to retrieve the
configuration file from the router to obtain its hashed credentials
and then exploits CVE-2019-1652 to execute arbitrary commands and
gain complete control of the affected device.

Researchers from cybersecurity firm Bad
Packets said they found at least 9,657 Cisco routers (6,247
RV320 and 3,410 RV325) worldwide that are vulnerable to the
information disclosure vulnerability, most of which located in the
United States.
^[3]

The firm shared an interactive map^[4], showing all vulnerable
RV320/RV325 Cisco routers in 122 countries and on the network of
1,619 unique internet service providers.

Bad Packets said its honeypots detected opportunistic scanning
activity for vulnerable routers from multiple hosts from Saturday,
suggesting the hackers are actively trying to exploit the flaws to
take full control of the vulnerable routers.

The best way to protect yourself from becoming the target of one
such attack is to install the latest Cisco RV320 and RV325 Firmware
release 1.4.2.20^[5]
as soon as possible.

Administrators who have not yet applied the firmware update are
highly recommended to change their router’s admin and WiFi
credentials considering themselves already compromised.