H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Vulnerability

CVE-2019-1652

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands.

Vulnerability
TypeVulnerability
External ID—
First seen2022-03-03
Last seen2022-03-03

Confidence

—

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands.

Labels

exploitedkev

CISA KEV context

Vendor / productCisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers
Added2022-03-03
Due date2022-03-17
52 recorded

Relationships

mitigates
from Remediate CVE-2019-1652
Mitigation
related-to
to Accessing/Intercepting/Modifying HTTP Cookies
Technique
related-to
to AJAX Footprinting
Technique
related-to
to Blind SQL Injection
Technique
related-to
to Buffer Overflow in an API Call
Technique
related-to
to Buffer Overflow in Local Command-Line Utilities
Technique
related-to
to Buffer Overflow via Environment Variables
Technique
related-to
to Buffer Overflow via Parameter Expansion
Technique
related-to
to Buffer Overflow via Symbolic Links
Technique
related-to
to Client-side Injection-induced Buffer Overflow
Technique
related-to
to Command Line Execution through SQL Injection
Technique
related-to
to Cross-Site Scripting (XSS)
Technique
related-to
to Cross Zone Scripting
Technique
related-to
to DOM-Based XSS
Technique
related-to
to Double Encoding
Technique
related-to
to Embedding NULL Bytes
Technique
related-to
to Exploiting Multiple Input Interpretation Layers
Technique
related-to
to Exploiting Trust in Client
Technique
related-to
to File Content Injection
Technique
related-to
to Filter Failure through Buffer Overflow
Technique
related-to
to Flash Injection
Technique
related-to
to Format String Injection
Technique
related-to
to Fuzzing
Technique
related-to
to Fuzzing for garnering other adjacent user/sensitive data
Technique
related-to
to Input Data Manipulation
Technique
related-to
to LDAP Injection
Technique
related-to
to Leverage Alternate Encoding
Technique
related-to
to MIME Conversion
Technique
related-to
to Object Relational Mapping Injection
Technique
related-to
to OS Command Injection
Technique
related-to
to Overflow Variables and Tags
Technique
related-to
to Oversized Serialized Data Payloads
Technique
related-to
to Postfix, Null Terminate, and Backslash
Technique
related-to
to Serialized Data with Nested Payloads
Technique
related-to
to Server Side Include (SSI) Injection
Technique
related-to
to Server Side Request Forgery
Technique
related-to
to Signature Spoof
Technique
related-to
to SQL Injection through SOAP Parameter Tampering
Technique
related-to
to String Format Overflow in syslog()
Technique
related-to
to Subverting Environment Variable Values
Technique
related-to
to URL Encoding
Technique
related-to
to User-Controlled Filename
Technique
related-to
to Using Escaped Slashes in Alternate Encoding
Technique
related-to
to Using Leading 'Ghost' Character Sequences to Bypass Input Filters
Technique
related-to
to Using Slashes and URL Encoding Combined to Bypass Validation Logic
Technique
related-to
to Using Slashes in Alternate Encoding
Technique
related-to
to Using Unicode Encoding to Bypass Validation Logic
Technique
related-to
to Using UTF-8 Encoding to Bypass Validation Logic
Technique
related-to
to Web Server Logs Tampering
Technique
related-to
to XML Injection
Technique
related-to
to XPath Injection
Technique
related-to
to XSS Using MIME Type Mismatch
Technique
2 external

References

nvd
CVE-2019-1652
open
cwe
CWE-20
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance