CVE-2023-20128
published 2023-04-05CVE-2023-20128: Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an…
PriorityP262high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
30.39%
98.0th percentile
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. These vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by sending malicious input to an affected device. A successful exploit could allow the attacker to execute arbitrary commands as the root user on the underlying Linux operating system of the affected device. To exploit these vulnerabilities, an attacker would need to have valid Administrator credentials on the affected device. Cisco has not released software updates to address these vulnerabilities.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_small_business_rv_series_router_firmware | — | — |
| cisco | small_business_rv320_and_rv325_dual_gigabit_wan_vpn_routers | — | — |
Detection & IOCsextracted from sources · hover to see the quote
path/cgi-bin/import_config.cgi
- →Exploit targets the web-based management interface via HTTP POST to /cgi-bin/import_config.cgi with a multipart/form-data body containing the 'USBconfigfile' parameter; injection characters include semicolon (;/%3B), newline (%0A), backtick (`/%60), pipe (|/%7C), dollar sign ($/%24), and IFS.
- →The URI path /cgi-bin/import_config.cgi has a fixed length of 26 bytes; use a URI length check (bsize:26) to reduce false positives when matching this endpoint.
- →Exploitation requires valid Administrator credentials; monitor for authenticated POST requests to the management interface from external/unexpected source IPs as a precursor indicator. ↗
- →A successful exploit results in command execution as root on the underlying Linux OS; correlate web management interface POST events with unexpected outbound connections or process spawning from the router. ↗
- ·No software patch is available from Cisco; affected devices (RV320 and RV325) remain permanently vulnerable and should be isolated or replaced. ↗
- ·The second Snort rule (sid:2060434) requires TLS decryption (tls_state TLSDecrypt / deployment SSLDecrypt) to fire on HTTPS management traffic; ensure your sensor has SSL inspection enabled or the rule will miss encrypted exploitation attempts.
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
vendor_cisco7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection Vulnerabilities
vendor_cisco·2023-04-05·CVSS 7.2
CVE-2023-20117 [HIGH] CWE-146 Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection Vulnerabilities
Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device.
These vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by sending malicious input to an affected device. A successful exploit could allow the attacker to execute arbitrary commands as the root user on the underlying Linux operating system of the affected device. To exploit these vulnerabilities, an attacker would need to have valid Administrator
Cisco
Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection Vulnerabilities
vendor_cisco·CVSS 3.1
CVE-2023-20128 Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection Vulnerabilities
CVE-2023-20128: Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. These vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by sending malicious input to an affected device. A successful exploit could allow the attacker to execute arbitrary commands as the root user on the underlying Linux operating system of the affected device. To exploit these vulnerabilities, an attacker would need to have valid
GHSA
GHSA-72q8-fjc4-6c3r: Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an aut
ghsa_unreviewed·2023-04-05
CVE-2023-20128 [HIGH] CWE-78 GHSA-72q8-fjc4-6c3r: Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an aut
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker to inject and execute arbitrary commands on the underlying operating system of an affected device.
These vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by sending malicious input to an affected device. A successful exploit could allow the attacker to execute arbitrary commands as the root user on the underlying Linux operating system of the affected device. To exploit these vulnerabilities, an attacker would need to have valid Administrator credentials on the affected device.
Cisco has not released software updates to address these vulnerab
Suricata
ET WEB_SPECIFIC_APPS Cisco RV Series Router import_config.cgi USBconfigfile Command Injection Attempt (CVE-2023-20128)
suricata·2025-07-21·CVSS 7.2
CVE-2023-20128 [HIGH] ET WEB_SPECIFIC_APPS Cisco RV Series Router import_config.cgi USBconfigfile Command Injection Attempt (CVE-2023-20128)
ET WEB_SPECIFIC_APPS Cisco RV Series Router import_config.cgi USBconfigfile Command Injection Attempt (CVE-2023-20128)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Cisco RV Series Router import_config.cgi USBconfigfile Command Injection Attempt (CVE-2023-20128)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:26; content:"/cgi-bin/import_config.cgi"; fast_pattern; http.request_body; content:"Content-Disposition|3a 20|form-data|3b 20|name|3d 22|USBconfigfile|22|"; pcre:"/^.*(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24)|IFS)+/R"; reference:url,www.iotsec-zone.com/article/383; reference:cve,2023-20128; classtype:web-application-attack; sid:2063623; rev:1; metadata:affected_product Cisco_RV_Series, attack_target
Suricata
ET WEB_SPECIFIC_APPS Cisco Small Business Router RV Series Command Injection (CVE-2023-20128)
suricata·2025-02-27·CVSS 7.2
CVE-2023-20128 [HIGH] ET WEB_SPECIFIC_APPS Cisco Small Business Router RV Series Command Injection (CVE-2023-20128)
ET WEB_SPECIFIC_APPS Cisco Small Business Router RV Series Command Injection (CVE-2023-20128)
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Cisco Small Business Router RV Series Command Injection (CVE-2023-20128)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/cgi-bin/import_config.cgi"; fast_pattern; http.content_type; content:"multipart/form-data|3b|"; http.request_body; content:"name|3d 22|USBconfigfile|22|"; content:"|3b|"; distance:0; reference:url,www.iotsec-zone.com/article/383; reference:cve,2023-20128; classtype:web-application-attack; sid:2060434; rev:1; metadata:affected_product Cisco_RV_Series, attack_target Server, tls_state TLSDecrypt, created_at 2025_02_27, cve CVE_2023_20128, deployment Perimeter, deployment I
No public exploits indexed.
No writeups or analysis indexed.
2023-04-05
Published