RV320/RV325: Cisco Small Business Routers Command Injection Vulnerability

Available Languages

Download Options

  • PDF     (852.7 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (923.3 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (398.1 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:February 12, 2019
Document ID:1550006372036121

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Defect Reference ID

CSCvm78058

Date Identified

October 5, 2018

Date Resolved

January 22, 2019

Products Affected

Model Firmware Version Fixed In
RV320 1.4.2.15 1.4.2.20
RV325 1.4.2.15 1.4.2.20

Problem Description

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands.

The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux shell as root.

Resolution

Cisco fixed this vulnerability in RV320 and RV325 Dual Gigabit WAN VPN routers firmware releases 1.4.2.20 and later.

Customers can download the firmware from the product page: RV320 and RV325 or Software Center on Cisco.com. The instructions below will show you how to download the firmware version 1.4.2.20 using the product page.

Step 1. Open the link for either the RV320 or RV325 product page.

Note: In this example, we will be using Cisco RV325 Dual Gigabit WAN VPN Router product page.

Step 2. Scroll down the page. The link should automatically bring you to the Downloads tab. If the link does not bring you to the Downloads tab, press the Downloads tab located next to the Documentation and Communities tab.

Step 3. Click the Downloads button next to the firmware version 1.4.2.20. The firmware version 1.4.2.20 should automatically start downloading.

Note: A notice will appear, “By downloading this file you acknowledge that you have read and agree to be bound by the terms and conditions of the Cisco End User License Agreement.”

Step 4. The firmware will be downloaded to your Downloads folder on your computer.

Step 5. For instructions on how to upgrade your firmware version on the RV320 and RV325 Dual Gigabit WAN VPN Routers, click the link to see the article: Firmware Management on RV320 and RV325 VPN Router Series.

To process escalation, click here to contact the Cisco Small Business Support Center (SBSC).

Was this Document Helpful?

FeedbackFeedback

Contact Cisco