Active Scans Target Cisco Small Biz Routers for Remote Code-Execution

UPDATE Malicious scanning activity targeting Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN routers is underway, with a swell of opportunistic probes looking for vulnerable devices ramping up since Friday. According to Bad Packets Report’s honeypot data, cyberattackers are targeting a pair of just-patched vulnerabilities that allow remote unauthenticated information disclosure (CVE-2019-1653) leading to remote code-execution (CVE-2019-1652) on the routers. There are more than 9,000 routers open to the attack, the firm found. The first vulnerability exists in the web-based management interface for RV320/RV325; a simple GET request for /cgi-bin/config.exp returns full details of the device’s configuration settings, including administrator credentials (the password is hashed though). “[This] could allow an unauthenticated, remote attacker to retrieve sensitive configuration information,” explained researcher Troy Mursch, in an advisory published over the weekend. “All configuration details of the RV320/RV325 router are exposed by this vulnerability.” Bad Packets Report’s own scanning efforts using BinaryEdge, which canvassed 15,309 unique IPv4 hosts, determined that 9,657 Cisco RV320/RV325 routers are vulnerable to CVE-2019-1653: Broken down, it works out to 6,247 vulnerable out of 9,852 Cisco RV320 routers scanned; and 3,410 vulnerable out of 5,457 Cisco RV325 routers scanned. These are mostly located in the United States, Mursch said, though overall, vulnerable devi...