Your RSA-2048 keys break in 2030. Find every one of them before attackers do.

CVE-2019-1663

CRITICAL

A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN…

Published
Feb 28, 2019
Updated
Nov 21, 2024
Affected
0 pkgs
Patched
None yet
Exploits
6 known

EPSS Exploitation Probability

via FIRST.org ↗
95.7%probability of exploitation in next 30 days
Very High Risk100th percentile+8.46%
84.3%89.0%93.7%98.3%91.5%95.7%Dec 25Apr 26Jun 26

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Description

A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The vulnerability is due to improper validation of user-supplied data in the web-based management interface. An attacker could exploit this vulnerability by sending malicious HTTP requests to a targeted device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system of the affected device as a high-privilege user. RV110W Wireless-N VPN Firewall versions prior to 1.2.2.1 are affected. RV130W Wireless-N Multifunction VPN Router versions prior to 1.0.3.45 are affected. RV215W Wireless-N VPN Router versions prior to 1.3.1.1 are affected.

Affected Products

3 products · 3 configurations
OS
rv110w firmwarecisco
< 1.2.2.1
range
OS
rv130w firmwarecisco
< 1.0.3.45
range
OS
rv215w firmwarecisco
< 1.3.1.1
range
Exploits & PoCs
6

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

EDB-46961remotehardware

Cisco RV130W 1.0.3.44 - Remote Stack Overflow

by @0x00string · Jun 4, 2019

Exploit-DB Source
EDB-46705remotehardware✓ Verified

Cisco RV130W Routers - Management Interface Remote Command Execution (Metasploit)

by Metasploit · Apr 15, 2019

Exploit-DB Source
EDB-47348remotehardware✓ Verified

Cisco RV110W/RV130(W)/RV215W Routers Management Interface - Remote Command Execution (Metasploit)

by Metasploit · Sep 3, 2019

Exploit-DB Source

Frequently Asked Questions

A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The vulnerability is due to improper validation of user-supplied data in the web-based management interface. An attacker could exploit this vulnerability by sending malicious HTTP requests to a targeted device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating syst
O3 Security · Impact-Aware SCA

Is CVE-2019-1663 in your stack?

O3 detects CVE-2019-1663 across dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my stack How O3 SCA works