CVE-2019-1653: Cisco Small Business WAN VPN Routers - Sensitive Information Disclosure
HoneyLabs honeypots recorded 9 probes matching CVE-2019-1653 from 7 distinct source IP addresses in the last 7 days, of which 6 on interactive sensors. Severity is rated high.
This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2021-11-03.
4 sources, all recognised research scanners, probed for CVE-2019-1653 on the interactive sensors. None of them sent the exploit payload.
What the sensors show
Probes arrived on 4 of the 7 days in this window. The busiest day was 2026-11-08, with 5. One address, 45.156.129.128, sent 33% of them. The largest source network was AS211680 (Sistemas Informaticos, S.A.), with 67% of the probes from 4 addresses. It is still being probed 5 years after CISA added it to the Known Exploited Vulnerabilities list. Over the last 90 days the sensors recorded 50 probes for it. Every probing client that negotiated TLS presented one JA4 fingerprint, t12i330500_5172cef6ed69_021165082e1c.
Request paths that identify it
- /cgi-bin/config.exp
Addresses probing it
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 45.156.129.128 | 3 | Sistemas Informaticos, S.A. · research scanner: Internet Census | Portugal |
| 185.180.141.55 | 1 | Zenlayer Inc · research scanner: Internet Census | Portugal |
| 185.226.196.25 | 1 | Zenlayer Inc · research scanner: Internet Census | Portugal |
| 185.226.197.60 | 1 | Zenlayer Inc · research scanner: Internet Census | Portugal |
| 45.156.128.178 | 1 | Sistemas Informaticos, S.A. · research scanner: Internet Census | Portugal |
| 45.156.129.127 | 1 | Sistemas Informaticos, S.A. · research scanner: Internet Census | Portugal |
| 45.156.129.137 | 1 | Sistemas Informaticos, S.A. · research scanner: Internet Census | Portugal |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS211680 | Sistemas Informaticos, S.A. | 6 | 4 |
| AS21859 | Zenlayer Inc | 3 | 3 |
Where it comes from
| Country | Probes |
|---|---|
| Portugal | 9 |
Captured requests
- /cgi-bin/config.exp
Requests the interactive sensors answered
- GET /cgi-bin/config.exp
HTTP client fingerprints
- b11cun040_00040016_aa48e2c8
CVE report
Open a specific CVE from the CVE tracker.