Cisco RV320 router Security researchers have observed ongoing internet scans and exploitation attempts against Cisco RV320 and RV325 WAN VPN routers, two models very popular among internet service providers and large enterprises. Also: Cisco removed its seventh backdoor account Attacks started on Friday, January 25, after security researcher David Davidson published a proof-of-concept exploit for two Cisco RV320 and RV325 vulnerabilities. The vulnerabilities are: Both vulnerabilities were discovered and privately reported to Cisco by Germany security firm RedTeam Pentesting [1, 2, 3]. Cisco released patches for both issues on Wednesday, January 23 [1, 2]. The current consensus is that attackers are using Davidson's proof-of-concept code to retrieve configuration details using CVE-2019-1652 and then using CVE-2019-1653 to run additional commands, taking full control over vulnerable devices. "I would advise affected users to upgrade to firmware version 1.4.2.20 and change their device passwords immediately," said security researcher Troy Mursch, of Bad Packets LLC, who first spotted the scans on Friday. "It's likely these routers will be targeted by miscreants for abuse, but to what degree yet is unknown. CVE-2019-1652 allows for further exploitation once the credentials are obtained," Mursch told ZDNet. "I'm in agreement with this guy," Mursch added, pointing ZDNet to one of Davidson's tweets. yeah basically anyone unpatched is probably fucked. except for the fact the 'wget' o...
Hackers are going after Cisco RV320/RV325 routers using a new exploit
ZDNet
·Published Jan 27, 2019
·Updated
Affected Software
2 affected components
Cisco RV320
Cisco RV325
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses ongoing attacks and exploitation attempts against Cisco RV320 and RV325 routers.
2
What security implications are discussed in relation to the Cisco routers?
The article highlights that these routers are being targeted by hackers, indicating a significant security risk for users.
3
What products or software are affected by the ongoing exploit?
The affected products are the Cisco RV320 and RV325 WAN VPN routers.
4
What type of attacks are being carried out against the Cisco routers?
The attacks involve internet scans and exploitation attempts aimed at compromising the routers.
5
Who are the common users of the Cisco RV320 and RV325 routers?
These router models are commonly used by internet service providers and large enterprises.