Versions (4)
Version DetailsCurrent
Rev: 1 • Oct 28, 2021, 12:00 PMET EXPLOIT Cisco RV320/RV325 RCE (CVE-2019-1653)
alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Cisco RV320/RV325 RCE (CVE-2019-1653)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"certificate_handle2.htm"; nocase; fast_pattern; http.request_body; content:"page=self_generator.htm"; nocase; content:"common_name="; pcre:"/[^\r\n]*(?:\x60|\x24|\x7c|\bsh\b)/Ri"; reference:url,www.redteam-pentesting.de/en/advisories/rt-sa-2018-004/-cisco-rv320-command-injection; reference:cve,2019-1653; classtype:attempted-admin; sid:2034278; rev:1; metadata:attack_target Networking_Equipment, created_at 2021_10_28, cve CVE_2019_1653, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2021_10_28;)
Oct 28, 2021, 12:00 PM
Oct 28, 2021, 12:00 PM
Sep 21, 2024, 3:00 AM
Sep 21, 2024, 3:00 AM
rules/emerging-exploit.rules