Thread by @bad_packets

Our honeypots recently detected opportunistic scanning activity targeting Cisco RV320/RV325 routers. A vulnerability exists in these routers that allow remote unauthenticated users to obtain the device's admin credentials – leading to RCE.
badpackets.net/over-9000-cisc…

Using data provided by @binaryedgeio, we've scanned 15,309 unique IPv4 hosts and determined a total of 9,657 Cisco RV320/RV325 routers are vulnerable to CVE-2019-1653.

This interactive map shows the total vulnerable hosts found per country:
docs.google.com/spreadsheets/d…

Due to the sensitive nature of this vulnerability, the IP addresses of affected routers won't be published publicly. We’ve shared our findings directly with Cisco PSIRT and @USCERT_gov for further investigation and remediation.

In addition, we've shared our findings with:
@CERT_at
@certbe
@circl_lu
@clcert
@CSAsingapore
@cybercentre_ca
@CyberGovAU
@ncsc_nl
Z-CERT.nl