CVE-2019-1724

CVE-2019-1724 describes a session management vulnerability in the web-based interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers. An unauthenticated, remote attacker could exploit this flaw by sending a crafted HTTP request to hijack an active, authorized user session. This could allow the attacker to gain control of the device with the privileges of the impersonated session, potentially creating new user accounts or altering device configurations. The vulnerability has a high CVSS score of 8.8, indicating a critical severity due to its network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. Exploitation requires an active user session and the ability to craft specific HTTP requests. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant public attention.