Read the docs
TI-2019-01450 Aliases CVE-2019-1827GHSA-82x3-cxj5-262m

Cisco Small Business RV320 and RV325 Routers Online Help Reflected Cross-Site Scripting Vulnerability

Priority LOW 30CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

A vulnerability in the Online Help web service of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the service. The vulnerability exists because the Online Help web service of an affected device insufficiently validates user-supplied input. An attacker could exploit this vulnerability by persuading a user of the service to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected service or access sensitive browser-based information.This vulnerability affects Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers running firmware releases prior to 1.4.2.22.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01271 70th percentileScored 2026-11-07
Fix Fixed Cisco Small Business RV Series Router Firmware (Cisco): 1.4.2.22

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Small Business RV Series Router Firmwarebefore 1.4.2.221.4.2.22Patch availableCNA
  • Cisco Small Business RV Series Router Firmware VendorCisco Affected before 1.4.2.22 Fixed in 1.4.2.22 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:o:cisco:rv320_firmware:*:*:*:*:*:*:*:*before 1.4.2.22VulnerableCisco
cpe:2.3:h:cisco:rv320:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:rv325_firmware:*:*:*:*:*:*:*:*before 1.4.2.22VulnerableCisco
cpe:2.3:h:cisco:rv325:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
  • cpe:2.3:o:cisco:rv320_firmware:*:*:*:*:*:*:*:* Versions before 1.4.2.22 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:rv320:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:rv325_firmware:*:*:*:*:*:*:*:* Versions before 1.4.2.22 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:rv325:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco

Remediation

  • Fix · CNA Cisco Small Business RV Series Router Firmware (Cisco) Fixed in 1.4.2.22

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Cisco Small Business RV Series Router Firmware 1.4.2.22

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2019-01451 Cisco Small Business RV320 and RV325 Routers Weak Credential Encryption VulnerabilityPriority LOW 36
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1827
  2. 2026-10-03 Alias added: GHSA-82x3-cxj5-262m

References

Advisory 1

  • TI-2023-06825 Command injection in Cisco Small Business RV Series Router Firmware KEVCVSS 3.1HIGH 7.2
  • TI-2019-01278 Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability KEVCVSS 3.1HIGH 7.2
  • TI-2019-01279 Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability KEVCVSS 3.1HIGH 7.5
  • TI-2023-06835 Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection Vulnerabilities CVSS 3.1HIGH 7.2
  • TI-2023-06824 Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers Command Injection Vulnerabilities CVSS 3.1HIGH 7.2
  • TI-2024-13445 Cisco Small Business RV042, RV042G, RV320, and RV325 Remote Command Execution Vulnerabilities CVSS 3.1CRITICAL 9.1
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences